24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T50a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Capa_get_geographical_location Sample 2e6fbd142bd5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2e6fbd142bd5…. Malware family: Capa_get_geographical_location. Threat score 100/100. 16/27 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73","keywords":["Malicious","Capa_get_geographical_location","malware analysis","sandbox report","threat intelligence","2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73"],"about":{"@type":"SoftwareApplication","name":"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Capa_get_geographical_location","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7c3,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin"26:T526," HTTP/1.1 301 Moved Permanently Date: Wed 10 Jun 2026 10:55:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server-Timing: cfEdge;dur=1 cfOrigin;dur=0 Location: https://citrum.io/ Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=3o9nApKqHU4LUW3lMuPCNSsPH45xk63N8OEq5y7%2FXYm11WzzXa2%2FPFGzVozlTv5%2Fa8gTrJ29j7TfmgkaMfZb41RsVMLY9GYOPPH5QaPf7MtsYFu%2BoF9W7T5r7I1TQemmS62xBQ%3D%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a097d7a5294449fc-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET / HTTP/1.1 Host: citrum.io Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Wed 10 Jun 2026 10:55:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Vary: Accept-Encoding Link: ; rel="https://api.w.org/" Link: ; rel="alternate"; title="JSON"; type="application/json" Link: ; rel=shortlink Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZJoeuYEcW3t6wmk4BShpoCjoNPIFJim4%2BS5getbHSoChma8SPW5o2TRtKEh2bsxMC5VjXTfcBisaUMHnCjQTRQdtHKYoX6Ywtp9fqomtOKqj1WF8q2mZkOEHVWI%3D"}]} Cf-Cache-Status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=7 cfOrigin;dur=1277 CF-RAY: a097d7a5da19ae00-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22766922207072656669783D226F673A2068747470733A2F2F6F67702E6D652F6E73232220.......33:T6d8,"k__BackingField\" (Indicator: \"countrycode\") in Source: 2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\n \"get_CountryCode\" (Indicator: \"countrycode\") in Source: 2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\n \"set_CountryCode\" (Indicator: \"countrycode\") in Source: 2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-575","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"Quasar.Client.Messages.SystemInformationHandler::Execute(Quasar.Common.Networking.ISender,Quasar.Common.Messages.GetSystemInfo) at 4e9d57c8b70e874ec714476e68eb40f6-6000161-SystemInformationHandler~Execute\n Quasar.Common.Messages.GetSystemInfoResponse::set_SystemInfos(System.Collections.Generic.List`1>) at 4e9d57c8b70e874ec714476e68eb40f6-6000162-SystemInformationHandler~Execute","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindowTitle\" (Indicator: \"GetForegroundWindow\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\" nuldel /a /q /f \"\" (Indicator: \"ping -\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\"), Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\ndel /a /q /f \\\"\" (Indicator: \"ping -\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")\n Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\nstart \\\"\\\" \\\"\" (Indicator: \"ping -\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"15006[Esc]

\" (Indicator: \"[esc]\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")\n Found string \"HostName\" (Indicator: \"hostname\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")\n Found string \"/K CHCP {0}\" (Indicator: \"chcp\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: 2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"2e6fbd142bd5622d2415adbb479d091d322e2f28e91ddc20e3f8b59a26b42a73.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a2942798d50a9f3a905b723"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"