26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Kryptik.Generic Sample 2fb2ef88e05e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2fb2ef88e05e…. Malware family: Kryptik.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2fb2ef88e05e8dff44e3efa3220a15be55ec847fa6702c14f8f81c05758477d4","keywords":["Malicious","Kryptik.Generic","malware analysis","sandbox report","threat intelligence","2fb2ef88e05e8dff44e3efa3220a15be55ec847fa6702c14f8f81c05758477d4"],"about":{"@type":"SoftwareApplication","name":"2fb2ef88e05e8dff44e3efa3220a15be55ec847fa6702c14f8f81c05758477d4.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"2fb2ef88e05e8dff44e3efa3220a15be55ec847fa6702c14f8f81c05758477d4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Kryptik.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T560," HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 132 Content-Type: application/json; charset=utf-8 Content-Security-Policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 5BDA5137AADF433DBEC22576417F72B6 Ref B: BY1AA1072317054 Ref C: 2026-06-08T06:45:54Z Date: Mon 08 Jun 2026 06:45:53 GMT with response body ==>7B2261737369676E6D656E74436F6E74657874223A223437444551706A38484253612B2F54496D572B354A4365755165526B6D354E4D704A575A473368537546....... "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/1.1 Host: px.ads.linkedin.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 sec-ch-ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67"" Response ==> HTTP/1.1 200 OK Content-Length: 108 Content-Type: image/png Content-Encoding: gzip Vary: Accept-Encoding Set-Cookie: lidc="b=VGST08:s=V:r=V:a=V:p=V:g=3451:u=1:x=1:i=1780901160:t=1780987560:v=2:sig=AQFJSWNzxNpUJmepUPfZ9a1uZa-fdcxS"; Expires=Tue 09 Jun 2026 06:46:00 GMT; domain=.linkedin.com; Path=/; SameSite=None; Secure LinkedIn-Action: 1 X-Li-Fabric: prod-lva1 Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} NEL: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Li-Pop: afd-prod-lva1-x X-Li-Proto: http/1.1 X-LI-UUID: AAZTuF0Mh6nBFJVaT3o1hw== X-Cache: CONFIG_NOCACHE Alt-Svc: h3=":443"; ma=86400 X-MSEdge-Ref: Ref A: B70FAE8E0A644AB994758EBF3331623B Ref B: BY1AA1072320042 Ref C: 2026-06-08T06:46:00Z Date: Mon 08 Jun 2026 06:45:59 GMT with response body ==>C289504E470D0A1A0A0000000D494844520000000100000001010300000025C39B56C38A00000003504C5445000000C2A77A3DC39A0000000174524E530040C3....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=arbitration_priority_list&version=39.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 271 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: 0D28852EFC6F49DB980C653D8B9BBD7A Ref B: SJC211051201027 Ref C: 2026-06-08T06:46:05Z Date: Mon 08 Jun 2026 06:46:04 GMT with response body ==>5B7B226E616D65223A226172626974726174696F6E5F7072696F726974795F6C697374222C2275726C223A2268747470733A2F2F656467656173736574736572....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=edge_hub_apps_manifest_gz&version=4.11.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 266 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: 0F41D245BE5244C49BA8BE3765772BE1 Ref B: BY1AA1072316034 Ref C: 2026-06-08T06:46:05Z Date: Mon 08 Jun 2026 06:46:05 GMT with response body ==>5B7B226E616D65223A22656467655F6875625F617070735F6D616E69666573745F677A222C2275726C223A2268747470733A2F2F656467656173736574736572....... "GET /entityextractiontemplates/api/v1/assets/find-assets?name=domains_config_gz&version=3.*.*&channel=stable&key=d414dd4f9db345fa8003e32adc81b362 HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" Response ==> HTTP/1.1 200 OK Cache-Control: public max-age=3600 Content-Length: 267 Content-Type: application/json; charset=utf-8 X-Cache: TCP_HIT X-Frame-Options: sameorigin X-MSEdge-Ref: Ref A: BA84EBB2A2C14FEB986AA195BEC601C7 Ref B: BY1AA1072316034 Ref C: 2026-06-08T06:46:05Z Date: Mon 08 Jun 2026 06:46:05 GMT with response body ==>5B7B226E616D65223A22646F6D61696E735F636F6E6669675F677A222C2275726C223A2268747470733A2F2F656467656173736574736572766963652E617A75....... "GET /abusiveadblocking/api/v1/blocklist HTTP/1.1 Host: edge.microsoft.com Connection: keep-alive If-None-Match: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B" Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.16299 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd" Response ==> HTTP/1.1 304 Not Modified Cache-Control: public max-age=43200 Content-Type: application/json; charset=utf-8 Content-Encoding: gzip ETag: "5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B" Vary: Accept-Encoding X-Cache: TCP_HIT X-FALCON-REF: Ref A: 7A750ECACD584C9E94B7FFB7C2CBDA97 Ref B: SC-WUS2-9PTZQ_AKS-GEN12-81428366-VMSS000009_FABRICROUTER-AZUREGLOBALPRIVATE-7B6F57BCF4-QNC4C Ref C: 2026-06-08T02:59:08Z X-Falcon-RouterStatusCode: SuccessfullyForwarded (200) X-Mesh-Client-TTL: 72 Strict-Transport-Security: max-age=0 X-MSEdge-Ref: Ref A: 57D2E15A7741460DA6B86AEC72727A1A Ref B: SJC211051203023 Ref C: 2026-06-08T06:46:06Z Date: Mon 08 Jun 2026 06:46:06 GMT with no response body "GET /sg/msn/1/cm?taboola_hm=222166F75FD3671F181970045E3D66DC&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Mon 08 Jun 2026 06:46:00 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940049-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 63455 X-Timer: S1780901160.070371 VS0 VE66 X-Cache: MISS X-Vcl-Time-Ms: 66 Cache-Control: no-cache no-store Accept-Ranges: bytes with response body ==>BINARY_CONTENT....... "GET /mapuid?member=280&user=222166F75FD3671F181970045E3D66DC;&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fm.adnxs.com%2Fseg%3Fadd%3D5159620%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fsetuid%253Fentity%253D483%2526code%253D222166F75FD3671F181970045E3D66DC%2526gdpr%253D0%2526gdpr_consent%253D HTTP/2 Host: m.adnxs.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" X-Edge-Shopping-Flag: 1 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 307 Temporary Redirect Content-Type: text/html; charset=utf-8 Date: Mon 08 Jun 2026 06:46:00 GMT Server: nginx/1.25.5 Set-Cookie: uuid2=5236844183772947417; SameSite=None; Path=/; Max-Age=7776000; Expires=Sun 06-Sep-2026 06:46:00 GMT; Domain=.adnxs.com; Secure; HttpOnly Expires: Sat 15 Nov 2008 16:00:00 GMT X-Xss-Protection: 0 An-X-Request-Uuid: 9370319e-53a7-4e01-9745-e0617a670050 X-Proxy-Origin: 64.124.12.162; 64.124.12.162; 906.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; *.adnxs.com Location: https://m.adnxs.com/bounce?%2Fmapuid%3Fmember%3D280%26user%3D222166F75FD3671F181970045E3D66DC%3B%26gdpr%3D0%26gdpr_consent%3D%26redir%3Dhttps%253A%252F%252Fm.adnxs.com%252Fseg%253Fadd%253D5159620%2526redir%253Dhttps%25253A%25252F%25252Fib.adnxs.com%25252Fsetuid%25253Fentity%25253D483%252526code%25253D222166F75FD3671F181970045E3D66DC%252526gdpr%25253D0%252526gdpr_consent%25253D Cache-Control: no-store no-cache private P3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml" CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Pragma: no-cache Accept-Ch: Sec-CH-UA-Full-Version-List Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Platform-Version Sec-CH-UA-Bitness with no response body "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/octet-stream Date: Mon 08 Jun 2026 06:46:06 GMT Last-Modified: Wed 08 Apr 2026 16:21:07 GMT X-Azure-Ref: 20260608T064606Z-r1cbf7d89942gsrbhC1ATLanx4000000038g000000000h14 X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Fd-Int-Roxy-Purgeid: 0 Vary: Accept-Encoding Content-Encoding: br X-Cache: TCP_HIT Cache-Control: public max-age=604800 X-Ms-Request-Id: 4ecb015b-201e-004b-075b-f53692000000 X-Ms-Blob-Type: BlockBlob with no response body "GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Mon 08 Jun 2026 06:46:22 GMT X-Azure-Ref: 20260608T064622Z-er1947c5f7cxsll7hC1IADu6v400000006b0000000003a56 X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Ms-Blob-Type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id Server x-ms-version Content-Type ETag Last-Modified x-ms-lease-status x-ms-blob-type Content-Length Date Transfer-Encoding Access-Control-Allow-Origin: * Last-Modified: Tue 24 Oct 2023 08:27:00 GMT X-Fd-Int-Roxy-Purgeid: 83583309 Etag: 0x8DBD46AFE482320 X-Cache: TCP_HIT Cache-Control: public max-age=432000 Accept-Ranges: bytes X-Ms-Request-Id: 903f4da5-601e-0079-54a9-f54e53000000 with no response body "GET /crx/blobs/AcPRoer4aKzvumujugdaImkRO90DhvB1jVZgnZQqHtOuS3CpNLYrK7J5tMTYvp_njyKFVYYoc3wd5iackYMogzXtBActnysgvTs0cM4JdDmi0ePXnnWj7xxeLXXe4BAM0WoAxlKa5bmSi3vwiVxq0nJ3VjtC1YYizVve/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4, i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip, deflate, br, zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AJ5rDhE48-yl7Eg8F5OoYkXWLGbYw9IhhRwMkcdJ-JqmjJ0DAIm2F59fuZghjh6luCMawzj6 Date: Sun 07 Jun 2026 21:55:23 GMT Server: UploadServer Last-Modified: Tue 19 May 2026 19:10:52 GMT Expires: Mon 07 Jun 2027 21:55:23 GMT Etag: 686d4ec9_e4c2c956_6bb9e431_3e1e6e46_3e0d24d2 Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 31859 X-Goog-Hash: crc32c=ubY9Gw== with response body ==>BINARY_CONTENT.......2e:T14a6," "{"request":{"@os":"win","@updater":"msedgecrx","acceptformat":"crx3 download run xz zucc","apps":[{"appid":"jmjflgjpcpepeafmmgdpfkogkghcpiha","cohort":"rrf@0.02","enabled":true,"installdate":6971,"installedby":"other","lang":"en-US","ping":{"ping_freshness":"{9d9e62d6-5520-4108-87f1-23636880fd52}","rd":6971},"targetingattributes":{"AppCohort":"rrf@0.02","AppMajorVersion":"145","AppRollout":0.02,"AppVersion":"145.0.3800.58","IsInternalUser":false,"Priority":false},"updatecheck":{},"version":"1.2.1"}],"arch":"x64","dedup":"cr","domainjoined":false,"hw":{"avx":1,"physmemory":8,"sse":1,"sse2":1,"sse3":1,"sse41":1,"sse42":1,"ssse3":1},"ismachine":1,"os":{"arch":"x86_64","platform":"Windows","version":"10.0.16299.248"},"prodversion":"145.0.3800.58","protocol":"4.0","requestid":"{b5af3d74-9ee3-4364-b9b3-0dfa673298df}","revocationviaomahaenabled":"0","sessionid":"{d04d58fd-d5d5-47be-b1dd-61252060562d}","updaterversion":"145.0.3800.58"}}" HTTP/1.1 200 OK Cache-Control: no-store must-revalidate no-cache max-age=0 Pragma: no-cache Content-Length: 162 Content-Type: application/json Content-Encoding: gzip Expires: Mon 01 Jan 1990 00:00:00 GMT X-Frame-Options: sameorigin X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: ED344C34DB294127895A3DC6D77B7717 Ref B: BY1AA1072320040 Ref C: 2026-06-08T06:46:22Z Date: Mon 08 Jun 2026 06:46:22 GMT with response body ==>295D7D270A7B22726573706F6E7365223A7B2270726F746F636F6C223A22342E30222C22736572766572223A2270726F64222C226461797374617274223A7B22....... "POST /chromewebstore/v1.1/items/verify HTTP/2 Host: www.googleapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Content-Type: application/json Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" with payload::==> "{"hash":"2l1MCjU2BtcJDaolsxJ1SfH3CPBRYLMELAfJB5y3CPY=","ids":["ghbmnnjooekpmoecnnnilnnbdlolhkhi"],"protocol_version":1}" HTTP/2 200 OK Content-Type: application/json; charset=UTF-8 Date: Mon 08 Jun 2026 06:46:06 GMT Server: ESF X-Xss-Protection: 0 X-Content-Type-Options: nosniff Vary: Referer Content-Encoding: gzip X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT.......1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2fb2ef88e05e8dff44e3efa3220a15be55ec847fa6702c14f8f81c05758477d4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790431318833,"unified_at":"2026-09-26T14:01:58.833Z","metadata":{"hashes":{"sha256":"2fb2ef88e05e8dff44e3efa3220a15be55ec847fa6702c14f8f81c05758477d4","sha1":"1b60010484b70216cd75c1af7ae6af6d5f687724","md5":"0554274843610eb9226e3534a8a8de10","sha512":"4ca9c68db2798f756b6cbbc12029aa71ebe3cf8e21177e172e5922c9f101d2229eda288811bda10cc48d347b27dedfc2d3a5c173903f2dd5701ab1145c2aabf4","ssdeep":"24576:eZPB3mZHQvlAVW07yyF4OHEQCvoGFRYo:uPRvKVJyqfHOvvFR","ssdeep_chunks":["24576:eZPB3mZ","24576:ZPB3mZH","24576:PB3mZHQ","24576:B3mZHQv","24576:3mZHQvl","24576:mZHQvlA","24576:ZHQvlAV","24576:HQvlAVW","24576:QvlAVW0","24576:vlAVW07","24576:lAVW07y","24576:AVW07yy","24576:VW07yyF","24576:W07yyF4","24576:07yyF4O","24576:7yyF4OH","24576:yyF4OHE","24576:yF4OHEQ","24576:F4OHEQC","24576:4OHEQCv","24576:OHEQCvo","24576:HEQCvoG","24576:EQCvoGF","24576:QCvoGFR","24576:CvoGFRY","24576:voGFRYo","49152:eZPB3mZ","49152:ZPB3mZH","49152:PB3mZHQ","49152:B3mZHQv","49152:3mZHQvl","49152:mZHQvlA","49152:ZHQvlAV","49152:HQvlAVW","49152:QvlAVW0","49152:vlAVW07","49152:lAVW07y","49152:AVW07yy","49152:VW07yyF","49152:W07yyF4","49152:07yyF4O","49152:7yyF4OH","49152:yyF4OHE","49152:yF4OHEQ","49152:F4OHEQC","49152:4OHEQCv","49152:OHEQCvo","49152:HEQCvoG","49152:EQCvoGF","49152:QCvoGFR","49152:CvoGFRY","49152:voGFRYo","24576:uPRvKVJ","24576:PRvKVJy","24576:RvKVJyq","24576:vKVJyqf","24576:KVJyqfH","24576:VJyqfHO","24576:JyqfHOv","24576:yqfHOvv","24576:qfHOvvF","24576:fHOvvFR"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"2fb2ef88e05e8dff44e3efa3220a15be55ec847fa6702c14f8f81c05758477d4.bin","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1157120,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1780748747000,"last_seen":1780901007000,"last_multi_scan":1780901007000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["wacatac"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":54},"sandbox_signatures":{"informative_count":98,"suspicious_count":8,"malicious_count":6,"total":112},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Formbook.X2183","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/MSIL.Noon","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Kryptik.477","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Malwarex-10059342-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Kryptik.477 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AQIU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Injector.nj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 005ce2dd1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.KBL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Kryptik.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Detected system process execution without parameters (likely process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","sources":[{"report_type":"sandbox","report_id":"6a26648e78995bbaf1051140"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"