34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3f:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T428,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 2b483789e8d6… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 2b483789e8d6…. Threat score 70/100. 0/27 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2b483789e8d6e150a2655a1d5d29ba689e481d6657739092b99ee936ed40b5f4","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","2b483789e8d6e150a2655a1d5d29ba689e481d6657739092b99ee936ed40b5f4"],"about":{"@type":"SoftwareApplication","name":"main.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"2b483789e8d6e150a2655a1d5d29ba689e481d6657739092b99ee936ed40b5f4","additionalType":"Suspicious sample"},"threatScore":70,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T4b7,file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), file/memory contains long string with (Indicator: "Thread32Next"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetCurrentProcess"; Source: "sample.bin"), file/memory contains long string with (Indicator: "EnumProcessModules"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetModuleHandle"; Source: "sample.bin"), file/memory contains long string with (Indicator: "QueryInformationProcess"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), file/memory contains long string with (Indicator: "EnumProcesses"; Source: "sample.bin"), file/memory contains long string with (Indicator: "Module32Next"; Source: "sample.bin"), file/memory contains long string with (Indicator: "Thread32First"; Source: "sample.bin"), file/memory contains long string with (Indicator: "Process32Next"; Source: "sample.bin"), file/memory contains long string with (Indicator: "Module32First"; Source: "sample.bin"), file/memory contains long string with (Indicator: "Process32First"; Source: "sample.bin")37:T443,Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; Source: "sample.bin"), Found string "internal/chacha8rand.block" (Indicator: "chacha"; Source: "sample.bin"), Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; Source: "sample.bin"), Found string "internal/runtime/maps.memHash32AES" (Indicator: "aes"; Source: "sample.bin"), file/memory contains long string with (Indicator: "aes"; Source: "sample.bin"), Found string "internal/runtime/maps.memHashAES" (Indicator: "aes"; Source: "sample.bin"), Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; Source: "sample.bin"), Found string "internal/runtime/maps.memHash64AES" (Indicator: "aes"; Source: "sample.bin"), Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; Source: "sample.bin"), Found string "internal/runtime/maps.initAlgAES" (Indicator: "aes"; Source: "sample.bin"), Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; Source: "sample.bin"), file/memory contains long string with (Indicator: "3des"; Source: "sample.bin")38:T409,file/memory contains long string with (Indicator: "LookupAccountName"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "sample.bin"), file/memory contains long string with (Indicator: "LookupAccountSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "WTSQueryUserToken"; Source: "sample.bin"), file/memory contains long string with (Indicator: "NtQueryInformationProcess"; Source: "sample.bin"), file/memory contains long string with (Indicator: "NtQueryObject"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetUserName"; Source: "sample.bin"), file/memory contains long string with (Indicator: "NetUserGetInfo"; Source: "sample.bin"), file/memory contains long string with (Indicator: "NtQuerySystemInformation"; Source: "sample.bin"), file/memory contains long string with (Indicator: "NetUserEnum"; Source: "sample.bin"), file/memory contains long string with (Indicator: "NetGetJoinInformation"; Source: "sample.bin")39:T418," is not a size class boundarygcControllerState.findRunnable: blackening not enabledno goroutines (main called runtime.Goexit) - deadlock!trace: non-empty full trace buffer for done generationtrace: non-empty full trace buffer for next generation goroutine running on other thread; stack unavailable bytes.Buffer: reader returned negative count from Readpanic calling String method on zero %v for flag %s: %vmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksat least one of the flags in the group [%v] is requiredSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesreflect: internal error: invalid use of makeMethodValuestrings: illegal use of non-zero Builder copied by valuerange function continued iteration after loop body panicrange function continued iteration after whole loop exitprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersfailed " in Source: sample.bin3a:Tbe4," which is not supported for fish shell set -l requestComp "%[10]s=0 $args[1] %[3]s $args[2..-1] $lastArg" __%[1]s_debug "Calling $requestComp" set -l results (eval $requestComp 2> /dev/null) # Some programs may output extra empty lines after the directive. # Let's ignore them or else it will break completion. # Ref: https://github.com/spf13/cobra/issues/1279 for line in $results[-1..1] if test (string trim -- $line) = "" # Found an empty line, remove it set results $results[1..-2] else # Found non-empty line, we have our proper output break end end set -l comps $results[1..-2] set -l directiveLine $results[-1] # For Fish, when completing a flag with an = (e.g., -n=) # completions must be prefixed with the flag set -l flagPrefix (string match -r -- '-.*=' "$lastArg") __%[1]s_debug "Comps: $comps" __%[1]s_debug "DirectiveLine: $directiveLine" __%[1]s_debug "" (Indicator: "github.com"), "user requested inserting one completion at a time, or all # completions at once on the command-line we must remove the descriptions. # https://github.com/spf13/cobra/issues/1508 # If there are no completions, we don't need to do anything (( ${#completions[@]} == 0 )) && return 0 local tab=$'\t' # Strip any description and escape the completion to handled special characters IFS=$'\n' read -ra completions -d '' < <(printf "%%q\n" "${completions[@]%%%%$tab*}") # Only consider the completions that match IFS=$'\n' read -ra COMPREPLY -d '' < <(IFS=$'\n'; compgen -W "${completions[*]}" -- "${cur}") # compgen looses the escaping so we need to escape all completions again since they will # all be inserted on the command-line. IFS=$'\n' read -ra COMPREPLY -d '' < <(printf "%%q\n" "${COMPREPLY[@]}") ;; *) # Type: complete (normal completion) __%[1]s_handle_standard_completion_case ;; " (Indicator: "github.com"), "path command-line-arguments dep MDHive (devel) dep github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w= dep github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= dep github.com/mattn/go-colorable v0.1.16 h1:+2YjeAe7xP1OQbZW1jERPWWCDLlNqFNCvjiqGiAt84A= dep github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI= dep github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= dep github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= dep golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= build -buildmode=exe build -compiler=gc build DefaultGODEBUG=tracebacklabels=0,x509sslcertoverrideplatform=0 build CGO_ENABLED=1 build CGO_CFLAGS= build CGO_CPPFLAGS= build CGO_CXXFLAGS= build CGO_LDFLAGS= build GOARCH=amd64 build GOOS=windows build GOAMD64=v1 " (Indicator: "github.com")3b:T61ac,Found api reference "VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailable bindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Standard TimeCape Verde Standard Timeconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWreflect.Value.SetComplexh" (Indicator: "CertFreeCertificateChain"; Source: "sample.bin"), Found api reference " message representativeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextinitial table capacity too large" not supported for cpu option "28421709430404007434844970703125use of closed network connectionreflect: NumOut of non-func typeGetVolumePathNamesForVolumeNameWsubtle.XORBytes: invalid overlapunsupported cryptography type: %sslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindRunnable: negative n" (Indicator: "CertAddCertificateContextToStore"; Source: "sample.bin"), Found api reference " message representativeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextinitial table capacity too large" not supported for cpu option "28421709430404007434844970703125use of closed network connectionreflect: NumOut of non-func typeGetVolumePathNamesForVolumeNameWsubtle.XORBytes: invalid overlapunsupported cryptography type: %sslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindRunnable: negative n" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "sample.bin"), Found api reference "tubtrace: out of memorywirep: already in goBASH_COMP_DEBUG_FILEJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timeinvalid write resultinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsreflect.Value.SetIntreflect.Value.Slice3httplaxcontentlengthx509usefallbackroots37252902984619140625index of untyped nilindex of nil pointerslice of untyped nilslice of nil pointerEgyptian_HieroglyphsMeroitic_HieroglyphsGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllGetConsoleCursorInfoSetConsoleCursorInfoChangeServiceConfigWCheckTokenMembershipQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWCertFindChainInStoreGetWindowsDirectoryWProcessIdToSessionIdSetVolumeMountPointWRtlInitUnicodeStringE" (Indicator: "CertFindChainInStore"; Source: "sample.bin"), Found api reference "tubtrace: out of memorywirep: already in goBASH_COMP_DEBUG_FILEJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timeinvalid write resultinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsreflect.Value.SetIntreflect.Value.Slice3httplaxcontentlengthx509usefallbackroots37252902984619140625index of untyped nilindex of nil pointerslice of untyped nilslice of nil pointerEgyptian_HieroglyphsMeroitic_HieroglyphsGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllGetConsoleCursorInfoSetConsoleCursorInfoChangeServiceConfigWCheckTokenMembershipQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWCertFindChainInStoreGetWindowsDirectoryWProcessIdToSessionIdSetVolumeMountPointWRtlInitUnicodeStringE" (Indicator: "CertOpenSystemStoreW"; Source: "sample.bin"), Found api reference "tubtrace: out of memorywirep: already in goBASH_COMP_DEBUG_FILEJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timeinvalid write resultinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsreflect.Value.SetIntreflect.Value.Slice3httplaxcontentlengthx509usefallbackroots37252902984619140625index of untyped nilindex of nil pointerslice of untyped nilslice of nil pointerEgyptian_HieroglyphsMeroitic_HieroglyphsGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllGetConsoleCursorInfoSetConsoleCursorInfoChangeServiceConfigWCheckTokenMembershipQueryServiceConfig2WQueryServiceStatusExRegisterEventSourceWCertFindChainInStoreGetWindowsDirectoryWProcessIdToSessionIdSetVolumeMountPointWRtlInitUnicodeStringE" (Indicator: "CryptAcquireContextW"; Source: "sample.bin"), Found api reference "goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizerfailed putFast after drainnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryGetFileInformationByHandleSouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Timeempty buffer in CopyBufferinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInforma" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found api reference "tionByHandle using unaddressable valueunknown ABI parameter kind1455191522836685180664062572759576141834259033203125too many slice indexes: %dnon-comparable type %s: %vRtlNtStatusToDosErrorNoTebGetConsoleScreenBufferInfoFillConsoleOutputAttributeGetSecurityDescriptorGroupGetSecurityDescriptorOwnerNotifyServiceStatusChangeWSetSecurityDescriptorGroupSetSecurityDescriptorOwnerCertFindCertificateInStoreFindFirstVolumeMountPointWFindNextChangeNotificationGetProcessWorkingSetSizeExGetSystemWindowsDirectoryWQueryFullProcessImageNameWSetProcessWorkingSetSizeExSetupDiBuildDriverInfoListentropy: nil memory bufferPageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertFindCertificateInStore"; Source: "sample.bin"), Found api reference "eReleaseMutexResumeThreadSetCommBreakSetCommStateSetConsoleCPSetErrorModeSetStdHandleThread32NextVirtualAllocCoCreateGuidunknown sizeInstAltMatchunexpected )altmatch -> anynotnl -> RCodeSuccessRCodeRefusedOK: %s 100%% relative to wakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flushedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: runtime: gp= idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase} sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=_activeHelp_ FindFirstFiledalTLDpSugct?level 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameinvalid base " (Indicator: "CertOpenStore"; Source: "sample.bin"), Found api reference " - span runtime.semasleep unexpectedfatal: morestack on gsignal runtime: casgstatus: oldval=gcstopm: negative nmspinningfindRunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too largeShellCompDirectiveNoFileCompShellCompDirectiveFilterDirsGetFileInformationByHandleExCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard TimeEnglish name for time zone "file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextreflect.MakeSlice: len > capabi.NewName: name too long: 18189894035458564758300781259094947017729282379150390625flag needs an argument: --%sinvalid slice index: %d > %dGetSecurityDescriptorControlInitializeSecurityDescriptorSetSecur" (Indicator: "CertCreateCertificateContext"; Source: "sample.bin"), Found api reference "ENIX named type fileCertEnumCertificatesInStorereflect.Value.UnsafePointer is not assignable to type BoundsDecode decoding errorabi.NewName: tag too long: httpservecontentkeepheadersx509sslcertoverrideplatform363797880709171295166015625invalid type for comparisoncan't index item of type %scan't slice item of type %sFillConsoleOutputCharacterWGetSecurityDescriptorLengthStartServiceCtrlDispatcherWFindCloseChangeNotificationGetNamedPipeClientProcessIdGetNamedPipeServerProcessIdGetUserPreferredUILanguagesSetupDiClassNameFromGuidExWSetupDiGetDeviceInstanceIdWSetupDiGetDriverInfoDetailWinvalid boolean flag %s: %vflag needs an argument: -%sexpression nests too deeplyoverflow on character value GC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/cleanups/queued:cleanups/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutines/sched/threads/total:threadsgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked" (Indicator: "CertEnumCertificatesInStore"; Source: "sample.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionWaitForSingleObjectGetFileAttributesExEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Timeunknown hash value skip this directorybad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Indexreflect.Value.Sliceembedfollowsymlinksgotestjsonbuildtextmultipartmaxheaders14901161193847656257450580596923828125bad flag syntax: %sInitial_PunctuationParagraph_SeparatorCanadian_AboriginalKhitan_Small_Scriptunexpected InstFailSetTokenInf" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found api reference "ritius Standard TimeMarquesas Standard Time" not found in registrydevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWreflect.Value.Interfacereflect.Value.NumMethod", missing CPU support 23283064365386962890625exit hook invoked panicbytes.Buffer: too largeGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockSetConsoleTextAttributeQueryServiceLockStatusWRegNotifyChangeKeyValueSetKernelObjectSecurityNotifyIpInterfaceChangeDeleteVolumeMountPointWFlushConsoleInputBufferGetActiveProcessorCountGetLogicalDriveStringsWSetInformationJobObjectSetNamedPipeHandleStateSetProcessPriorityBoostNtSetInformationProcessGetFileVersionInfoSizeWinvalid escape sequencepattern bits too long: number of worker threadstracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: " (Indicator: "CertGetCertificateChain"; Source: "sample.bin"), Found api reference "unknown flag: --%slen of nil pointerCaucasian_Albaniancontext.BackgroundGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed fileCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExGetIpForwardEntry2GetIpForwardTable2NotifyRouteChange2ClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameW/Drivers/etc/hostsRCodeServerFailurego fips object v1 reflect.Value.IsNilreflect.Value.Floatbad unicode format strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad index, gp->atomicstatus=marking free ob" (Indicator: "CertGetNameStringW"; Source: "sample.bin"), Found api reference "unknown flag: --%slen of nil pointerCaucasian_Albaniancontext.BackgroundGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed fileCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExGetIpForwardEntry2GetIpForwardTable2NotifyRouteChange2ClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameW/Drivers/etc/hostsRCodeServerFailurego fips object v1 reflect.Value.IsNilreflect.Value.Floatbad unicode format strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad index, gp->atomicstatus=marking free ob" (Indicator: "CryptUnprotectData"; Source: "sample.bin"), Found api reference "unknown flag: --%slen of nil pointerCaucasian_Albaniancontext.BackgroundGetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed fileCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidMakeSelfRelativeSDCertGetNameStringWCryptUnprotectDataPFXImportCertStoreGetBestInterfaceExGetIpForwardEntry2GetIpForwardTable2NotifyRouteChange2ClosePseudoConsoleEscapeCommFunctionGetCommModemStatusGetConsoleOutputCPGetCurrentThreadIdGetModuleHandleExWGetVolumePathNameWRemoveDllDirectorySetConsoleOutputCPTerminateJobObjectWriteProcessMemoryEnumProcessModulesGetModuleBaseNameW/Drivers/etc/hostsRCodeServerFailurego fips object v1 reflect.Value.IsNilreflect.Value.Floatbad unicode format strongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad index, gp->atomicstatus=marking free ob" (Indicator: "PFXImportCertStore"; Source: "sample.bin"), Found api reference "ationTitlecase_LetterUppercase_LetterImperial_AramaicMeroitic_CursiveZanabazar_Squareregexp: Compile(DuplicateTokenExSetEntriesInAclWCreateNamedPipeWGetCurrentThreadGetModuleHandleWRtlVirtualUnwindSetConsoleTitleWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExInstRuneAnyNotNLRCodeFormatErrorskip-verification Finished in: %s 0123456789ABCDEFX0123456789abcdefxreflect.Value.Intillegal hex digitcan't scan type: goroutine profileAllThreadsSyscallcontainermaxprocsGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycletrace proc statussync.(*Cond).Wait: missing method invalid addrBytesinvalid wordBytesnotetsleepg on g0bad TinySizeClassimmortal metadataruntime: pointer g already scannedmark - bad statusscanObject n == 0swept cached spanmarkBits overflo" (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found api reference "runtime.newosprocinternal/runtime/removed GODEBUG "thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != niltaggedPointerPackunknown caller pcstack: frame={sp:trace arena allocruntime: nameOff runtime: typeOff runtime: textOff COBRA_ACTIVE_HELP%s [command-line]winreadlinkvolumeGTB Standard TimeFLE Standard TimeGMT Standard Timepermission deniedwrong medium typeno data availableexec format errorLookupAccountSidWDnsRecordListFreeGetCurrentProcessGetShortPathNameWWSAEnumProtocolsWinvalid bit size unknown type kindreflect: call of reflect.Value.Capreflect.Value.Lenreflect: New(nil)multipartmaxpartsurlmaxqueryparams1192092895507812559604644775390625 (DEPRECATED: %s)Close_PunctuationFinal_PunctuationOther_PunctuationOld_North_ArabianOld_South_ArabianRegLoadMUIStringWAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExGetKeyboardLayoutWTSQueryUserTokenunexpected resultmissing closing )missing closing ]CREATED: %s 100%% reflect.Value.Uintun" (Indicator: "CertFindExtension"; Source: "sample.bin"), Found api reference "runtime.newosprocinternal/runtime/removed GODEBUG "thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=gp.waiting != niltaggedPointerPackunknown caller pcstack: frame={sp:trace arena allocruntime: nameOff runtime: typeOff runtime: textOff COBRA_ACTIVE_HELP%s [command-line]winreadlinkvolumeGTB Standard TimeFLE Standard TimeGMT Standard Timepermission deniedwrong medium typeno data availableexec format errorLookupAccountSidWDnsRecordListFreeGetCurrentProcessGetShortPathNameWWSAEnumProtocolsWinvalid bit size unknown type kindreflect: call of reflect.Value.Capreflect.Value.Lenreflect: New(nil)multipartmaxpartsurlmaxqueryparams1192092895507812559604644775390625 (DEPRECATED: %s)Close_PunctuationFinal_PunctuationOther_PunctuationOld_North_ArabianOld_South_ArabianRegLoadMUIStringWAdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQueryWorkingSetExGetKeyboardLayoutWTSQueryUserTokenunexpected resultmissing closing )missing closing ]CREATED: %s 100%% reflect.Value.Uintun" (Indicator: "CryptDecodeObject"; Source: "sample.bin"), Found api reference "ect: Len of non-array type reflect.MakeSlice: negative lenreflect.MakeSlice: negative cap11368683772161602973937988281255684341886080801486968994140625missing argument for comparisonvalue has type %s; should be %smergeRuneSets odd length []runeCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailWcrypto/aes: len(dst) < len(src)slice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pages/gc/finalizers/queued:finalizersruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointergetWeakHandle on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertDuplicateCertificateContext"; Source: "sample.bin"), Found api reference "[2K%s %.1f%%userArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limit stopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=help [command]%s version %s unexpected EOFfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntaxunsafe.Pointer on zero Valueunknown methodcryp" (Indicator: "CertCloseStore"; Source: "sample.bin"), Found api reference "[2K%s %.1f%%userArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer finalizers + GC worker initruntime: full=runtime: want=scan: class L MB; allocated allspans arrayscavenge indexno deferreturnbad restart PC-thread limit stopm spinningruntime: p id nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: goid=help [command]%s version %s unexpected EOFfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #invalid syntaxunsafe.Pointer on zero Valueunknown methodcryp" (Indicator: "CryptGenRandom"; Source: "sample.bin"), Found api reference "ack locals stack map entries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeruntime.AddCleanup: ptr is nilstrings: negative Repeat countcalled entry on non-entry nodeEastern Standard Time (Mexico)Turks And Caicos Standard TimeCentral Standard Time (Mexico)E. South America Standard TimePacific Standard Time (Mexico)Central European Standard Timesocket operation on non-socketinappropriate ioctl for deviceprotocol wrong type for socketMapIter.Key called before Nextreflect: Elem of invalid type reflect: Out of non-func type GODEBUG: unknown cpu feature "227373675443232059478759765625reflect: Len of non-array typesync: inconsistent mutex statesync: unlock of unlocked mutexGetSecurityDescriptorRMControlQueryServiceDynamicInformationSetSecurityDescriptorRMControlCertDeleteCertificateFromStoreGetProcessPreferredUILanguagesGetSystemTimePreciseAsFileTimeSetupDiCreateDeviceInfoListExWSetupDiGetDeviceInstallParamsWSetupDiSetDeviceInstallParamsWfips: invalid self-test name: f" (Indicator: "CertDeleteCertificateFromStore"; Source: "sample.bin")3c:T492,file/memory contains long string with (Indicator: "CertOpenSystemStore"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CryptAcquireContext"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CertFindCertificateInStore"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CertEnumCertificatesInStore"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CryptReleaseContext"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CertGetNameString"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CryptUnprotectData"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CryptProtectData"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CryptDecodeObject"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CertCloseStore"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CertDeleteCertificateFromStore"; Source: "sample.bin")3d:T89b,Found reference to API "ationTitlecase_LetterUppercase_LetterImperial_AramaicMeroitic_CursiveZanabazar_Squareregexp: Compile(DuplicateTokenExSetEntriesInAclWCreateNamedPipeWGetCurrentThreadGetModuleHandleWRtlVirtualUnwindSetConsoleTitleWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetFileValidDataSetPriorityClassVirtualProtectExRtlGetCurrentPebEnumChildWindowsGetDesktopWindowGetGUIThreadInfoWinVerifyTrustExInstRuneAnyNotNLRCodeFormatErrorskip-verification Finished in: %s 0123456789ABCDEFX0123456789abcdefxreflect.Value.Intillegal hex digitcan't scan type: goroutine profileAllThreadsSyscallcontainermaxprocsGC assist markingselect (no cases)sync.RWMutex.Lockwait for GC cycletrace proc statussync.(*Cond).Wait: missing method invalid addrBytesinvalid wordBytesnotetsleepg on g0bad TinySizeClassimmortal metadataruntime: pointer g already scannedmark - bad statusscanObject n == 0swept cached spanmarkBits overflo" (Indicator: "enumchildwindows"; Source: "sample.bin"), Found reference to API "at32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: running < 0runtime: g : frame.sp=created by ACTIVE_HELP Aliases: /dev/stdout/dev/stderrOpenProcessGetFileTypeshort writeSHA-512/224SHA-512/256BLAKE2s-256BLAKE2b-256BLAKE2b-384BLAKE2b-512broken pipebad messagefile existsbad addressRegCloseKeyCloseHandleCreateFileWDeleteFileWExitProcessFreeLibrarySetFileTimeVirtualLockWSARecvFromclosesocketgetpeernamegetsocknamecrypt32.dllmswsock.dllsecur32.dllshell32.dlluserenv.dllbad argSizemethodargs(reflect.Setgocachehashgocachetesthttp2clienthttp2serverrandseednoparchive/tarcrypto/x509archive/ziptls10server30517578125 -%s, --%sMath_SymbolPrivate_UsePunctuationDives_AkuruMedefaidrinNag_MundariNandinagariNew_Tai_LueOld_PersianOld_SogdianPau_Cin_HauSignWritingTolong_SikiWarang_CitiProcessPrngMoveFileExWNetShareAddNetShareDeli/o timeoutsechost.dllversion.dllGetFileTimeSetCommMaskVirtualFreeNetUserEnumNtSetEaFileCoGetObjectEnumWindowsMessageBoxWToUnicodeExInstCaptureInstRuneAny[:^xdigit:]ClassHESIODsweepWaiterscleanupQueuetr" (Indicator: "enumwindows"; Source: "sample.bin")3e:Teb1,file/memory contains long string with (Indicator: "GetSecurityDescriptorGroup"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorOwner"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetSecurityDescriptorGroup"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorLength"; Source: "sample.bin"), file/memory contains long string with (Indicator: "EqualSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; Source: "sample.bin"), file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetKernelObjectSecurity"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "MakeSelfRelativeSD"; Source: "sample.bin"), file/memory contains long string with (Indicator: "DuplicateToken"; Source: "sample.bin"), file/memory contains long string with (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "AdjustTokenGroups"; Source: "sample.bin"), file/memory contains long string with (Indicator: "IsTokenRestricted"; Source: "sample.bin"), file/memory contains long string with (Indicator: "IsValidSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorSacl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; Source: "sample.bin"), file/memory contains long string with (Indicator: "IsValidSecurityDescriptor"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetSecurityDescriptorSacl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetLengthSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "RevertToSelf"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorRMControl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetSecurityDescriptorRMControl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "FreeSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "InitializeSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "IsWellKnownSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "MakeAbsoluteSD"; Source: "sample.bin"), file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CopySid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetAce"; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"2b483789e8d6e150a2655a1d5d29ba689e481d6657739092b99ee936ed40b5f4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1794723170612,"unified_at":"2026-11-15T06:12:50.612Z","metadata":{"hashes":{"sha256":"2b483789e8d6e150a2655a1d5d29ba689e481d6657739092b99ee936ed40b5f4","sha1":"ac04f2978693ab8c587dee90cac95a753fe7e711","md5":"ffa9ac6d1788f7af5057c529d45205b0"},"file_info":{"file_name":"main.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":3192320,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794723163000,"last_seen":1794723163000,"last_multi_scan":1794723163000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":129,"suspicious_count":3,"malicious_count":0,"total":132},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to set/delete MS-DOS device name (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability retrieve IPv4 mapping information (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to change the configuration parameters of a service"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"informative","value":"Able to retrieve information set for devices (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate logon sessions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\", YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-44","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ForEach-Object\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Where-Object\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Sort-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-374","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-437","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"file/memory contains long string with (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"QueryInformationFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ReadDirectoryChange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-118","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$38","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1087","id":"string-452","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in \"sample.bin\", Found registry query API: \"RegNotifyChangeKeyValue (in long string)\" in \"sample.bin\", Found registry query API: \"RegEnumValue (in long string)\" in \"sample.bin\", Found registry query API: \"RegQueryValue (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-PSReadLineKeyHandler\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-394","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"file/memory contains long string with (Indicator: \"GetLogicalDriveStrings\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetLogicalDrives\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"file/memory contains long string with (Indicator: \"getlogicaldrivestringsw\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-730","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability retrieve IPv4 mapping information (API string)","description":"file/memory contains long string with (Indicator: \"GetIpForwardTable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-87","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"file/memory contains long string with (Indicator: \"GetDesktopWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"file/memory contains long string with (Indicator: \"GetProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-478","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-86","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"file/memory contains long string with (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-224","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"file/memory contains long string with (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"file/memory contains long string with (Indicator: \"QueryDosDevice\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-227","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate logon sessions (API string)","description":"file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1049","id":"string-117","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"EnumDependentServices\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"EnumServicesStatus\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-Expression\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-288","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"CommandLineToArgv\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtOpenFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtCreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"file/memory contains long string with (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"MoveFileExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"file/memory contains long string with (Indicator: \"CloseServiceHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-242","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$3a","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegLoadMUIString (in long string)\" in \"sample.bin\", Found registry modification API: \"RegCreateKey (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-225","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1136.001","id":"string-214","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"file/memory contains long string with (Indicator: \"LoadResource\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindResource\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SizeofResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetShellWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"file/memory contains long string with (Indicator: \"VirtualFree\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WriteProcessMemory\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FreeMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"file/memory contains long string with (Indicator: \"ChangeServiceConfig\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ControlService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-192","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"file/memory contains long string with (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"file/memory contains long string with (Indicator: \"SetWaitableTimer\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SleepEx\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetTickCount64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"file/memory contains long string with (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiGetClassDevs\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SetupDiGetDeviceRegistryProperty\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497","id":"string-253","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-690","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HMAC\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SHA384\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SHA512\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SetThreadToken\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OpenThreadToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1132","id":"string-338","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1069.002","id":"string-981","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$3b","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$3c","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptUnprotectData\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptUnprotectData\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-920","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-108","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetVolumePathName\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SetVolumeMountPoint\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindFirstVolume\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindFirstVolumeMountPoint\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindNextVolume\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindNextVolumeMountPoint\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindVolumeMountPointClose\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindVolumeClose\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1006","id":"string-194","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumePathNamesForVolumeName\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetVolumeInformation\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-162","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"file/memory contains long string with (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-910","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FreeSid\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"file/memory contains long string with (Indicator: \"ProcessIdToSessionId\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WTSFreeMemory\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-906","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in \"sample.bin\", Found system information discovery API: \"QuerySystemInformation (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"file/memory contains long string with (Indicator: \"GetUserPreferredUILanguages\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetKeyboardLayout\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"file/memory contains long string with (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"EnumWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"file/memory contains long string with (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"file/memory contains long string with (Indicator: \"GetLogicalDriveStringsW\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetLogicalDrives\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetDriveTypeW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-998","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3d","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-739","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"file/memory contains long string with (Indicator: \"setupdigetclassdevs\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"setupdigetdeviceregistryproperty\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"setupdienumdeviceinfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-533","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-659","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-907","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetInformationFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NtSetInformationFile\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.002","id":"string-168","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"file/memory contains long string with (Indicator: \"changeserviceconfigw\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-10073","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$3e","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to set/delete MS-DOS device name (API string)","description":"file/memory contains long string with (Indicator: \"DefineDosDevice\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-466","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-402","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"file/memory contains long string with (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValue (in long string)\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"file/memory contains long string with (Indicator: \"TerminateProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"file/memory contains long string with (Indicator: \"CoGetObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548.002","id":"string-239","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"file/memory contains long string with (Indicator: \"SetupDiDestroyDeviceInfoList\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1485","id":"string-442","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-File\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Out-Null\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Out-String\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-373","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"file/memory contains long string with (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"OpenMutex\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-PSReadLineKeyHandler\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-395","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"file/memory contains long string with (Indicator: \"InitiateSystemShutdown\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-223","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \"gethostbyname\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" socket \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"wsastartup\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"wsacleanup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"GetNamedPipe\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CreateNamedPipe\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ConnectNamedPipe\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"file/memory contains long string with (Indicator: \"WSASend\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WSAStartup\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WSARecv\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"file/memory contains long string with (Indicator: \"WSASend\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WSAStartup\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WSARecv\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1095","id":"string-228","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-736","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\", Found HTTPS url \"https://go.dev\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://github.com/spf13/cobra/issues/1279\", Pattern match: \"https://github.com/spf13/cobra/issues/1508\", Heuristic match: \"internal/abi.name.name\", Pattern match: \"github.com/fatih/color\", Pattern match: \"https://go.dev/doc/godebug#go-1casgstatus\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NetUserEnum\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1087.001","id":"string-112","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"file/memory contains long string with (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Register-ArgumentCompleter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-396","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"file/memory contains long string with (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"file/memory contains long string with (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CreateService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"file/memory contains long string with (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"WTSEnumerateSessions\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-546","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"file/memory contains long string with (Indicator: \"WTSFreeMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1021.001","id":"string-436","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"file/memory contains long string with (Indicator: \"cmd=\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-29","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserDel\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1531","id":"string-216","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"file/memory contains long string with (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample 2b483789e8d6… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 2b483789e8d6…. Threat score 70/100. 0/27 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2b483789e8d6e150a2655a1d5d29ba689e481d6657739092b99ee936ed40b5f4"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 2b483789e8d6… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 2b483789e8d6…. Threat score 70/100. 0/27 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2b483789e8d6e150a2655a1d5d29ba689e481d6657739092b99ee936ed40b5f4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 2b483789e8d6… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 2b483789e8d6…. Threat score 70/100. 0/27 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]] 32:null