26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.PasswordStealerA.Generic Sample 21fb5e039247… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 21fb5e039247…. Malware family: MSIL.PasswordStealerA.Generic. Threat score 100/100. 14/26 AV engines flagged this file. 8 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7","keywords":["Malicious","MSIL.PasswordStealerA.Generic","malware analysis","sandbox report","threat intelligence","21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7"],"about":{"@type":"SoftwareApplication","name":"ratonClient.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.PasswordStealerA.Generic","antivirusDetections":{"malicious":14,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7d7,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetTypeFromCLSID" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetFunctionPointerForDelegate" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin"28:T9f8,21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "youtube_LOriFzhoUTA_628x480_h264" size: "293044" and abnormal entropy:"7.92517278638491" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.aforge.video.directshow.dll.compressed" size: "31842" and abnormal entropy:"7.991515642366471" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.naudio.asio.dll.compressed" size: "14637" and abnormal entropy:"7.981740184575931" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.naudio.core.dll.compressed" size: "81405" and abnormal entropy:"7.995206685705053" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.naudio.midi.dll.compressed" size: "20853" and abnormal entropy:"7.984796934574505" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.naudio.wasapi.dll.compressed" size: "76002" and abnormal entropy:"7.991652341764986" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.naudio.winforms.dll.compressed" size: "14830" and abnormal entropy:"7.9830347080220125" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.naudio.winmm.dll.compressed" size: "25540" and abnormal entropy:"7.985683913880299" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.newtonsoft.json.dll.compressed" size: "272899" and abnormal entropy:"7.991127166764327" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.system.memory.dll.compressed" size: "59807" and abnormal entropy:"7.995401382862062" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.system.numerics.vectors.dll.compressed" size: "32868" and abnormal entropy:"7.984935838008249" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.system.resources.extensions.dll.compressed" size: "33668" and abnormal entropy:"7.990599052240979" 21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin has big resource with name: "costura.system.security.accesscontrol.dll.compressed" size: "13323" and abnormal entropy:"7.980502218263154"29:T87a,"s" + r-p(# o$ &Xi2o% +*0*(& io' (!,o( *0*() io' (!,o( *0* (* io' (!,o( *"(+ *r3prips, s, *{*"}*V(+ s- ((*0A ,rprp( (. ('(/ %-&~0 o1 o2 *V('(3 o2 *V('(4 o2 *V('(5 o2 *B('o2 *0('(4 (2+*0xi ,R+_s6 s7 io8 ,o( o9 ii,RR ,o( *(7 Nk0j ( s: s; +! Yo< ,+ X -,o( ,o( +*3JHW0(0i-+ s6 s= ﾭo> io? o? o@ oA (o> o9 ,o( ,o( *&Qw g 0s: sB oC ﾭ ,rpsD zoE oE oF oG oC (,rpsD z_ -+ (1,o( ,o( *0s6 (/ sH oI o? oJ +O(K (/ (L o1 io? oA (M io? (M oA (N -o( o9 ,o( ,o( *()\0s- s: (/ sO oE +AoE (/ oG oP oE oG o2 X -,o( ,o( + *\vu{ *"} *>(5(7*0 (6,(6oQ + +*0$(9 ,+(6oR +*0.(9 ,+(/ (6oR oP +*0*(9 ,+(6oR (S +*0*(9 ,+(6oR (T +*0*(9 ,+(6oR (U +*0+(9 ,j+(6oR (V +*02(9 ,#+(6oR (W +*0 (: +*0(6 +*"(+ *.sE*"(+ *^~oX oY oZ *BSJBv4.0.30319l#~\#StringsH#US`#GUIDp#BlobW 31 F*ZH/bE,HFzOUe r dx;kV 6/ 5{Fx 0 m,mAamAmA'mA0mA2mA 4mA 6! AD111nQiQQTn6 C C rC 4C #C C C |C C C C )C ~C rC C sC C ;C C C RC VCP ) )$!* !.!3d"e8"8 "8 @#8##*#>#H# #S 1$YG$_]$\es$k${$rrH%{{%&x'Wd(a$)>,)H5) H)!t)Z4")#)R$*%P*c&*'*(+4)+A>*4+*=+**I+*R+ * QQQQDDDDDDcJL*D )19AIQYaiqyA=pCGNgm)))1G)a))9CACNIQFNNY0&a+1aH4:iHBiHHiHNhqls{qGllll2=1>$$9$:>=Cadjvii~iGiriAW $....#.+.3.;.C.K.S.[.c0.kZ.sg{A{AC{{{{{ ,37 "T[Gp} v8' -w?]Z !#%')+-/13'5(56777`0m: )\-/<>9__4_0b__4_0SHA1IEnumerable`1Crc32ReadUInt32ReadInt32ToInt32Func`2KeyValuePair`2Dictionary`2ToInt64MD5ToInt16SHA256get_UTF8<>9get_UACget_UIDSHA1_STRINGMD5_STRINGSHA256_STRINGget_VMSystem.IOINTEGERpackedDatadatamscorlib<>cPaccUnpaccMagicSystem.Collections.Genericget_HidProcReadpayloadFlagCompressedcompressedk__BackingFieldSendAppendRoundget_PasswordCompressionModeDecodeEncodeIClientBridgeBuildTableEnumerableIDisposableToDoubleGetAsDoubleget_HideFileConsolePacketFrameframeWriteLineSystem.CoreDisposeCreateDebuggerBrowsableStateWriteget_Websiteget_OpenWebsiteCompilerGeneratedAttributeGuidAttributeDebuggableAttributeDebuggerBrowsableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeComputeReadByteget_ValuevalueoriginalSizeSerializeDeserializeStuffget_TagEncodingSystem.Runtime.VersioningBytesToStringGetAsStringGetStringSetStringGetAsLongSetLongLogget_BoxMsgComputeHashMathget_LengthlengthPackUnpackget_ProcessCriticalCompressionLevelGetAllStuff.dllGetAsBoolSetBoolDeflateStreamMemoryStreamget_Itemset_ItemSystemHashAlgorithmlengthRandomcharsRandomToBooleanSignget_BoxIconget_VersionSystem.IO.CompressionSystem.ReflectionInvalidDataExceptionget_StartupSystem.LinqBinaryReaderStringBuilderget_DefenderGetAsIntegerToUpperBinaryWriterBitConverterPacketSerializerFloorPacketCompressorGetEnumerator.ctor.cctorHasAbsSystem.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesDebuggingModesReadBytesGetBytesbytesget_CharsHelpersMinSizeToCompressDecompressget_Objectsset_ObjectsobjectsConcatRepeatObjectSelectget_ReconnectSetoffsetget_BoxTitSetIntget_Currentget_CountbyteCountConvertget_PortGetAsShortget_Assistget_HostMoveNextSystem.Textget_RawGetRawPowConvertToHexget_Mutexget_Boxget_UACByget_DelayGetAsByteArrayToArrayget_KeyContainsKeykeySystem.Security.CryptographyEmptyBKBMBGBTBPBEB0x25abcdefghijklmnopqrstuvwxyz0123456789[Warning: SetString called with null for key ''Invalid magicCRC mismatch̆Cb a ] ] I IMM QQUUi mq mq mu my mu} }} imyi i z\V4ﾭ Ei (] i i ii ((( (iTWrapNonExceptionThrows StuffCopyright © 2026)$cee53f6d-bc5f-4d2c-837a-a6b40a8ca6d51.0.0.0M.NETFramework Version=v4.7.2TFrameworkDisplayName.NET Framework 4.7.2WWF(RSDSi!qN9EC:\Users\Cristian\source\repos\Stuff\Stuff\obj\Debug\Stuff.pdbWGqG cG_CorDllMainmscoree.dll% 0HX`4VS_VERSION_INFO?DVarFileInfo$Translation\StringFileInfo8000004b0Comments"CompanyName4FileDescriptionStuff0FileVersion1.0.0.04 InternalNameStuff.dllHLegalCopyrightCopyright 2026*LegalTrademarks< OriginalFilenameStuff.dll,ProductNameStuff4ProductVersion1.0.0.08Assembly Version1.0.0.0@7"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791156190549,"unified_at":"2026-10-04T23:23:10.549Z","metadata":{"hashes":{"sha256":"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7","sha1":"ba14ba9f05dc608e77e62cd1aca15da0350c4d59","md5":"832f9bd4bd5b18e3764d9c6750504636","sha512":"2edba616bcdb341b5c4da38b2e0ef1b0eff6ed7cb326acaa85b8377499c12ad750191ce215956e78184a5a767db3efbbfc70e571b626d8a40f778da3ac392a4b","ssdeep":"49152:/ugVUlsHjkmiGWU5FLGpMZ7iKPJ5W16sclR0BxMfzaRw4msF:/ugVUuHjkDGjzqpgmwQ13uRxfzew","ssdeep_chunks":["49152:/ugVUls","49152:ugVUlsH","49152:gVUlsHj","49152:VUlsHjk","49152:UlsHjkm","49152:lsHjkmi","49152:sHjkmiG","49152:HjkmiGW","49152:jkmiGWU","49152:kmiGWU5","49152:miGWU5F","49152:iGWU5FL","49152:GWU5FLG","49152:WU5FLGp","49152:U5FLGpM","49152:5FLGpMZ","49152:FLGpMZ7","49152:LGpMZ7i","49152:GpMZ7iK","49152:pMZ7iKP","49152:MZ7iKPJ","49152:Z7iKPJ5","49152:7iKPJ5W","49152:iKPJ5W1","49152:KPJ5W16","49152:PJ5W16s","49152:J5W16sc","49152:5W16scl","49152:W16sclR","49152:16sclR0","49152:6sclR0B","49152:sclR0Bx","49152:clR0BxM","49152:lR0BxMf","49152:R0BxMfz","49152:0BxMfza","49152:BxMfzaR","49152:xMfzaRw","49152:MfzaRw4","49152:fzaRw4m","49152:zaRw4ms","49152:aRw4msF","98304:/ugVUls","98304:ugVUlsH","98304:gVUlsHj","98304:VUlsHjk","98304:UlsHjkm","98304:lsHjkmi","98304:sHjkmiG","98304:HjkmiGW","98304:jkmiGWU","98304:kmiGWU5","98304:miGWU5F","98304:iGWU5FL","98304:GWU5FLG","98304:WU5FLGp","98304:U5FLGpM","98304:5FLGpMZ","98304:FLGpMZ7","98304:LGpMZ7i","98304:GpMZ7iK","98304:pMZ7iKP","98304:MZ7iKPJ","98304:Z7iKPJ5","98304:7iKPJ5W","98304:iKPJ5W1","98304:KPJ5W16","98304:PJ5W16s","98304:J5W16sc","98304:5W16scl","98304:W16sclR","98304:16sclR0","98304:6sclR0B","98304:sclR0Bx","98304:clR0BxM","98304:lR0BxMf","98304:R0BxMfz","98304:0BxMfza","98304:BxMfzaR","98304:xMfzaRw","98304:MfzaRw4","98304:fzaRw4m","98304:zaRw4ms","98304:aRw4msF","49152:/ugVUuH","49152:ugVUuHj","49152:gVUuHjk","49152:VUuHjkD","49152:UuHjkDG","49152:uHjkDGj","49152:HjkDGjz","49152:jkDGjzq","49152:kDGjzqp","49152:DGjzqpg","49152:Gjzqpgm","49152:jzqpgmw","49152:zqpgmwQ","49152:qpgmwQ1","49152:pgmwQ13","49152:gmwQ13u","49152:mwQ13uR","49152:wQ13uRx","49152:Q13uRxf","49152:13uRxfz","49152:3uRxfze","49152:uRxfzew"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"ratonClient.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":3003904,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1774794520000,"last_seen":1774794526000,"last_multi_scan":1774794526000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["infostealer","njrat","rat","evasive"]},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":81},"sandbox_signatures":{"informative_count":174,"suspicious_count":11,"malicious_count":8,"total":193},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.ClipBanker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.MSIL.PasswordStealerA.8C07A5E9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Adwarex-9851111-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.MSIL.PasswordStealerA.8C07A5E9 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/PSW.Agent.SHS trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/MSIL.AsyncRAT.aa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/MSIL-BG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-FRAX!832F9BD4BD5B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSIL.PasswordStealerA.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to control system service controller"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Contains key cryptographic functions of the CryptoAPI"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Contains ability to perform AES cryptographic operations (Dotnet)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"YARA signature match – high entropy image embedded in .NET resource"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using web history"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"informative","value":"Contains ability to perform code compilation at runtime (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to collect clipboard information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"suspicious","value":"Contains ability to simulate user keyboard/mouse input"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"malicious","value":"Reads the SCSI logical unit identifier"},{"type":"malicious","value":"Reads the system/video BIOS version"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to obtain MAC address in .NET file"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Queries disk-related registry keys"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve security identifier details"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Checks internet connectivity using tracert/ping"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Able to access Steam setting"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to download remote files (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"suspicious","value":"Able to reboot/shutdown the operating system"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to access Steam setting","description":"Found string \"Software\\\\Valve\\\\Steam\" (Indicator: \"software\\\\valve\\\\steam\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")\n Found string \"Software\\\\Valve\\\\Steam\\\\Apps\" (Indicator: \"software\\\\valve\\\\steam\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")","origin":"File/Memory","mitre_attack_id":"T1518","relevance":1,"id":"string-763","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\"\n Observed Namespace \"System.Windows.Forms.Control\" and MemberReference \"Hide\" in \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"$27","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"-NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass \\\"Add-MpPreference -ExclusionProcess '\" (Indicator: \"add-mppreference\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")\n Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")\n Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"21fb5e039247e3b506be23d5a6b370dd5ca6a84d7ce77fd09e97a3af770909b7.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69c9371d353da604f80510d8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"