34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 44:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 40862d281bae… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 40862d281bae…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281"],"about":{"@type":"SoftwareApplication","name":"40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281","applicationCategory":["peexe","assembly","executable"],"identifier":"40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Ta0d,Found reference to API "TimeSpan2.dll" (Indicator: "time"; Source: "sample.bin"), Found reference to API "TimeSpan2.dll" (Indicator: "times"; Source: "sample.bin"), Found reference to API "Can't set TakeSamples after calling Read" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SysInfo >> Failed fetch system info " (Indicator: "sysinfo"; Source: "sample.bin"), Found reference to API "BuildMapCreator" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "Accepted" (Indicator: "accept"; Source: "sample.bin"), Found reference to API "Blob is not open" (Indicator: "open"; Source: "sample.bin"), Found reference to API "Failed to read metaevent's data fully" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Connection lock object was {0} with statement {1}" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "Connection lock object was {0} with statement {1}" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "virtual table "{0}" is read-only" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadString" (Indicator: "read"; Source: "sample.bin"), Found reference to API " [Open google maps](" (Indicator: "open"; Source: "sample.bin"), Found reference to API "TimerThread#" (Indicator: "read"; Source: "sample.bin"), Found reference to API "TimerThread#" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Request Timeout" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ConfigSecurityPolicy.exe" (Indicator: "security"; Source: "sample.bin"), Found reference to API "WriteUInt64" (Indicator: "write"; Source: "sample.bin"), Found reference to API "CreateValue" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "SendAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "virtual table cursor is closed" (Indicator: "close"; Source: "sample.bin"), Found reference to API "the file {0} exists; will overwrite it..." (Indicator: "write"; Source: "sample.bin"), Found reference to API "Sec-WebSocket-Version" (Indicator: "socket"; Source: "sample.bin"), Found reference to API "The connection handle is invalid." (Indicator: "connect"; Source: "sample.bin"), Found reference to API "net.pipe" (Indicator: "pipe"; Source: "sample.bin"), Found reference to API "Cannot write a " (Indicator: "write"; Source: "sample.bin"), Found reference to API "timeout=15,max={0}" (Indicator: "time"; Source: "sample.bin"), Found reference to API "PreComputeUnionReader" (Indicator: "read"; Source: "sample.bin")37:T612,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: sample.bin, "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" in Source: sample.bin, "Software\" in Source: sample.bin, "\BraveSoftware\Brave-Browser\Waluigi" "data:text/html,Welcome to HVNC !

Welcome to HVNC !

" --allow-no-sandbox-job --disable-3d-apis --disable-accelerated-layers --disable-accelerated-plugins --disable-audio --disable-gpu --disable-d3d11 --disable-accelerated-2d-canvas --disable-deadline-scheduling --disable-ui-deadline-scheduling --aura-no-shadows --mute-audio" in Source: sample.bin, "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: sample.bin, "HARDWARE\Description\System\CentralProcessor\0" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: sample.bin38:T6f8,"SELECT * FROM [{0}].[{2}] WHERE [type] LIKE 'index' AND [name] LIKE '{1}'" (Source: sample.bin, Indicator: "select * from [{0}].[{2}] where [type] like 'index' and [name] like '{1}'"), "Select * from Win32_Processor" (Source: sample.bin, Indicator: "select * from win32_processor"), "Select * from Win32_CacheMemory" (Source: sample.bin, Indicator: "select * from win32_cachememory"), "Select * from AntivirusProduct" (Source: sample.bin, Indicator: "select * from antivirusproduct"), "SELECT * FROM Win32_OperatingSystem" (Source: sample.bin, Indicator: "select * from win32_operatingsystem"), "SELECT * FROM Win32_VideoController" (Source: sample.bin, Indicator: "select * from win32_videocontroller"), "select * from Win32_VideoController" (Source: sample.bin, Indicator: "select * from win32_videocontroller"), "CREATE TABLE {0}(x);" (Source: sample.bin, Indicator: "create table {0}(x);"), "SELECT [type], [name], [tbl_name], [rootpage], [sql], [rowid] FROM [{0}].[{1}] WHERE [type] LIKE 'table'" (Source: sample.bin, Indicator: "select [type], [name], [tbl_name], [rootpage], [sql], [rowid] from [{0}].[{1}] where [type] like 'table'"), "Select * From Win32_ComputerSystem" (Source: sample.bin, Indicator: "select * from win32_computersystem"), "SELECT ProcessId, Name, ExecutablePath FROM Win32_Process" (Source: sample.bin, Indicator: "select processid, name, executablepath from win32_process"), "SELECT * FROM Win32_Processor" (Source: sample.bin, Indicator: "select * from win32_processor"), "SELECT ExecutablePath, ProcessID FROM Win32_Process" (Source: sample.bin, Indicator: "select executablepath, processid from win32_process"), "SELECT * FROM [{0}].[{1}] WHERE [type] LIKE 'view'" (Source: sample.bin, Indicator: "select * from [{0}].[{1}] where [type] like 'view'")39:T511,Found string "SystemInfo >> GetPublicIP : Request error " (Indicator: "systeminfo"; Source: "sample.bin"), file/memory contains long string with (Indicator: "arp -a"; Source: "sample.bin"), file/memory contains long string with (Indicator: "hostname"; Source: "sample.bin"), file/memory contains long string with (Indicator: "net localgroup"; Source: "sample.bin"), file/memory contains long string with (Indicator: "net localgroup administrators"; Source: "sample.bin"), file/memory contains long string with (Indicator: "net user"; Source: "sample.bin"), file/memory contains long string with (Indicator: "net user administrator"; Source: "sample.bin"), file/memory contains long string with (Indicator: "netstat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "route"; Source: "sample.bin"), file/memory contains long string with (Indicator: "route print"; Source: "sample.bin"), file/memory contains long string with (Indicator: "sc query"; Source: "sample.bin"), file/memory contains long string with (Indicator: "systeminfo"; Source: "sample.bin"), file/memory contains long string with (Indicator: "tasklist"; Source: "sample.bin"), Found string "PING" (Indicator: "ping"; Source: "sample.bin"), Found string "NETSTAT" (Indicator: "netstat"; Source: "sample.bin")3a:T4f1,Found string "Firefox >> Failed to copy files to decrypt passwords " (Indicator: "password"; Source: "sample.bin"), file/memory contains long string with (Indicator: "password"; Source: "sample.bin"), Found string "A username, password, and domain must be provided." (Indicator: "password"; Source: "sample.bin"), Found string "Recoverer >> Failed recursive remove directory with passwords" (Indicator: "password"; Source: "sample.bin"), Found string "FileZilla >> Failed to collect passwords from {0} {1}" (Indicator: "password"; Source: "sample.bin"), Found string "Firefox >> Failed collect passwords " (Indicator: "password"; Source: "sample.bin"), Found string "Tasks which have been registered previously with stored passwords must use the TaskFolder.RegisterTaskDefinition method for updates." (Indicator: "password"; Source: "sample.bin"), Found string "password" (Indicator: "password"; Source: "sample.bin"), Found string "A password cannot be supplied when specifying TaskLogonType.Group." (Indicator: "password"; Source: "sample.bin"), Found string "passwordBlob" (Indicator: "password"; Source: "sample.bin"), Found string "With 'HidePassword' enabled, passwords can only be set via the connection string." (Indicator: "password"; Source: "sample.bin")3b:T913,Found string "The archive requires a ZIP64 Central Directory. Consider setting the ZipFile.UseZip64WhenSaving property." (Indicator: "zipfile"; Source: "sample.bin"), Found string "ZipFile::{0}" (Indicator: "zipfile"; Source: "sample.bin"), Found string " Inconsistent size (0x{0:X4}) in WinZip AES field at position 0x{1:X16}" (Indicator: "aes"; Source: "sample.bin"), Found string "Twofish" (Indicator: "twofish"; Source: "sample.bin"), Found string "You must call ZipFile.Save before calling any Extract method" (Indicator: "zipfile"; Source: "sample.bin"), Found string "Use Extract() only with ZipFile." (Indicator: "zipfile"; Source: "sample.bin"), Found string "net_http_parser_invalid_base64_string" (Indicator: "base64"; Source: "sample.bin"), Found string " ZipFile: {0} " (Indicator: "zipfile"; Source: "sample.bin"), Found string "The number of entries is 65535 or greater. Consider setting the UseZip64WhenSaving property on the ZipFile instance." (Indicator: "zipfile"; Source: "sample.bin"), Found string "PKWare AES256" (Indicator: "aes"; Source: "sample.bin"), Found string "PKWare AES256" (Indicator: "aes256"; Source: "sample.bin"), Found string "ZipFile" (Indicator: "zipfile"; Source: "sample.bin"), Found string "PKWare AES128" (Indicator: "aes"; Source: "sample.bin"), Found string "PKWare AES128" (Indicator: "aes128"; Source: "sample.bin"), Found string "Use OpenReader() only with ZipFile." (Indicator: "zipfile"; Source: "sample.bin"), Found string "You must call ZipFile.Save before calling OpenReader" (Indicator: "zipfile"; Source: "sample.bin"), Found string "PKWare AES192" (Indicator: "aes"; Source: "sample.bin"), Found string "PKWare AES192" (Indicator: "aes192"; Source: "sample.bin"), Found string "ZipFile::Save: could not delete temp file: {0}." (Indicator: "zipfile"; Source: "sample.bin"), Found string " Unexpected vendor ID (0x{0:X4}) for WinZip AES metadata at position 0x{1:X16}" (Indicator: "aes"; Source: "sample.bin"), Found string "3DES-112" (Indicator: "3des"; Source: "sample.bin"), Found string "3DES-112" (Indicator: "3des-112"; Source: "sample.bin"), Found string "3DES-168" (Indicator: "3des"; Source: "sample.bin"), Found string "3DES-168" (Indicator: "3des-168"; Source: "sample.bin"), Found string "Blowfish" (Indicator: "blowfish"; Source: "sample.bin")3c:T57c,Found string "Select * from Win32_Processor" (Indicator: " Win32_Process"; Source: "sample.bin"), Found string "Select * from Win32_Processor" (Indicator: " Win32_Processor"; Source: "sample.bin"), Found string "Select * from Win32_CacheMemory" (Indicator: " Win32_CacheMemory"; Source: "sample.bin"), Found string " SELECT * FROM win32_operatingsystem" (Indicator: " Win32_OperatingSystem"; Source: "sample.bin"), Found string "Select * from AntivirusProduct" (Indicator: "antivirusproduct"; Source: "sample.bin"), Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "sample.bin"), Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "sample.bin"), Found string "select * from Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "sample.bin"), Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "sample.bin"), Found string "SELECT ProcessId, Name, ExecutablePath FROM Win32_Process" (Indicator: " Win32_Process"; Source: "sample.bin"), Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "sample.bin"), Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "sample.bin"), Found string "SELECT ExecutablePath, ProcessID FROM Win32_Process" (Indicator: " Win32_Process"; Source: "sample.bin")3d:T42e,Observed string: "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" (Indicator: " tasklist ") in Source: sample.bin3e:T413,Observed string: "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" [Source: sample.bin]3f:T496,Found string "SELECT * FROM [{0}].[{2}] WHERE [type] LIKE 'index' AND [name] LIKE '{1}'" (Indicator: "select * from "; Source: "sample.bin"), Found string "Select * from Win32_Processor" (Indicator: "select * from "; Source: "sample.bin"), Found string "Select * from Win32_CacheMemory" (Indicator: "select * from "; Source: "sample.bin"), Found string " SELECT * FROM win32_operatingsystem" (Indicator: "select * from "; Source: "sample.bin"), Found string "Select * from AntivirusProduct" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "sample.bin"), Found string "select * from Win32_VideoController" (Indicator: "select * from "; Source: "sample.bin"), Found string "Select * From Win32_ComputerSystem" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; Source: "sample.bin"), Found string "SELECT * FROM [{0}].[{1}] WHERE [type] LIKE 'view'" (Indicator: "select * from "; Source: "sample.bin")40:T7f1,"Select * from Win32_Processor" (Indicator: " win32_process"; Source: "sample.bin"), "Select * from Win32_CacheMemory" (Indicator: " win32_cachememory"; Source: "sample.bin"), "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" (Indicator: "logicaldisk get"; Source: "sample.bin"), " SELECT * FROM win32_operatingsystem" (Indicator: " win32_operatingsystem"; Source: "sample.bin"), "SELECT * FROM Win32_OperatingSystem" (Indicator: " win32_operatingsystem"; Source: "sample.bin"), "SELECT * FROM Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "sample.bin"), "select * from Win32_VideoController" (Indicator: " win32_videocontroller"; Source: "sample.bin"), "Select * From Win32_ComputerSystem" (Indicator: " win32_computersystem"; Source: "sample.bin"), "SELECT ProcessId, Name, ExecutablePath FROM Win32_Process" (Indicator: " win32_process"; Source: "sample.bin"), "SELECT * FROM Win32_Processor" (Indicator: " win32_process"; Source: "sample.bin"), "SELECT ExecutablePath, ProcessID FROM Win32_Process" (Indicator: " win32_process"; Source: "sample.bin")41:T42e,Observed string: "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" (Indicator: "query user") in Source: sample.bin42:T437,Found string "ConfigSecurityPolicy.exe" (Indicator: "configsecuritypolicy.exe"; Source: "sample.bin"), Found string "Regedit.exe" (Indicator: "regedit.exe"; Source: "sample.bin"), Found string "procexp.exe" (Indicator: "procexp.exe"; Source: "sample.bin"), Found string "Taskmgr.exe" (Indicator: "taskmgr.exe"; Source: "sample.bin"), Found string "NisSrv.exe" (Indicator: "nissrv.exe"; Source: "sample.bin"), Found string "MpCmdRun.exe" (Indicator: "mpcmdrun.exe"; Source: "sample.bin"), Found string "taskkill.exe" (Indicator: "taskkill.exe"; Source: "sample.bin"), Found string "MSConfig.exe" (Indicator: "msconfig.exe"; Source: "sample.bin"), Found string "UserAccountControlSettings.exe" (Indicator: "useraccountcontrolsettings.exe"; Source: "sample.bin"), Found string "MSASCui.exe" (Indicator: "msascui.exe"; Source: "sample.bin"), Found string "MpUXSrv.exe" (Indicator: "mpuxsrv.exe"; Source: "sample.bin"), Found string "ProcessHacker.exe" (Indicator: "processhacker.exe"; Source: "sample.bin"), Found string "MsMpEng.exe" (Indicator: "msmpeng.exe"; Source: "sample.bin")43:T404,Found api reference "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "sample.bin"), Found api reference "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794312582425,"unified_at":"2026-11-10T12:09:42.425Z","metadata":{"hashes":{"sha256":"40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281","sha1":"f9ac54a3dd560f32d938b8273112a437d1b778a8","md5":"95c7fded6d729f5b2df1777bdfbbb6a0"},"file_info":{"file_name":"40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":3369984,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794312574000,"last_seen":1794312575000,"last_multi_scan":1794312575000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":5,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":47},"sandbox_signatures":{"informative_count":59,"suspicious_count":22,"malicious_count":5,"total":86},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/MSIL.Stealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AsyncRat.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Dump:Generic.Trojan.Cryo.Marte.D.84111D8C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Razy-9807129-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dump:Generic.Trojan.Cryo.Marte.D.84111D8C (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.CAK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.AsyncRAT.dd!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Banker.d","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005690671 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/MSIL-BG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-PWS/W32.DN-InfoStealer.3369984","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"BackDoor-FEZT!95C7FDED6D72","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.4485822","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"RAT","sources":[{"report_type":"qsp","report_id":""}]},{"value":"Stealer","sources":[{"report_type":"qsp","report_id":""}]},{"value":"Dump:Generic.Trojan.Cryo.Marte.D","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"AsyncRAT","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"suspicious","value":"Contains scheduled task related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"suspicious","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Contains ability to enumerate system services using Tasklist"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browsers sensitive information related strings"},{"type":"suspicious","value":"Found Crypto currency wallets related strings"},{"type":"suspicious","value":"Found desktop apps credentials related location strings"},{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"suspicious","value":"Identified FTP credentials location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"YARA signature match - Queries video controller using WMI"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Contains asymmetric cryptographic functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"suspicious","value":"Able to access crypto wallet extension (string)"},{"type":"suspicious","value":"Able to retrieve browser history information"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using web history"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains native function calls (syscalls strings)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"informative","value":"References task scheduler-related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"References Video COM interface string"},{"type":"informative","value":"Contains ability to retrieve system configuration"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"References to WMI query strings used for information discovery"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"suspicious","value":"Able to retrieve local system accounts"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Local Groups","attack_id":"T1069.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/001","identifiers":[{"type":"informative","value":"Able to retrieve local groups information"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"},{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to scan the ARP cache"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify System Firewall","attack_id":"T1686","attack_id_wiki":"https://attack.mitre.org/techniques/T1686","identifiers":[{"type":"suspicious","value":"Able to modify firewall settings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"suspicious","value":"Able to retrieve local network connections"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create local account"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the current user information"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"References hosts file in file/memory"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"Pattern Matching","name":"YARA signature match – WorldWind stealer","description":"YARA signature WorldWind stealer matched on file \"sample.bin\"","origin":"Static Analysis","id":"yara-133","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - generic stealer","description":"YARA signature Malware.Stealer matched on file \"sample.bin\"","origin":"Static Analysis","id":"yara-8","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Queries video controller using WMI","description":"YARA signature for WMI query for video controller matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1047","id":"yara-51","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - AsyncRAT","description":"YARA signature for AsyncRAT malware matched on file \"sample.bin\"","origin":"Static Analysis","id":"yara-6","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\"), Found string \" Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$38","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"twitter\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"youtube\" (Indicator: \"youtube\"; Source: \"sample.bin\"), Found string \"paypal\" (Indicator: \"paypal\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/LimerBoy/StormKitty\" (Indicator: \"github.com\"), \"https://discordapp.com/api/v6/users/@me\" (Indicator: \"discordapp.com\"), \"Are you mixing protobuf-net and protobuf-csharp-port? See https://stackoverflow.com/q/11564914/23354; type: \" (Indicator: \"stackoverflow.com\"), \"https://discordapp.com/api/v6/users/@me/billing/payment-sources\" (Indicator: \"discordapp.com\"), \"https://discordapp.com/api/v6/users/@me/billing/subscriptions\" (Indicator: \"discordapp.com\"), \"; please see https://stackoverflow.com/q/14436606/23354\" (Indicator: \"stackoverflow.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"Send-MailMessage -From '{0}' -Subject '{1}' -SmtpServer '{2}' -Encoding UTF8\" (Indicator: \"Send-MailMessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"WriteProcessMemory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"Wow64GetThreadContext\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"Local State\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"Wow64SetThreadContext\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"NtProtectVirtualMemory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SetThreadContext\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateProcessW\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateProcessA\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ReadProcessMemory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ZwUnmapViewOfSection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"MpCmdRun.exe\" (Indicator: \"mpcmdrun.exe\") in Source: sample.bin, \"Antivirus\" (Indicator: \"antivirus\") in Source: sample.bin, \"MSASCui.exe\" (Indicator: \"msascui.exe\") in Source: sample.bin, \"\nAntivirus: \" (Indicator: \"antivirus\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"ExecutionPolicy Bypass Start-Process -FilePath '\"\" (Indicator: \"Start-Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-250","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\"), Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"References task scheduler-related strings","description":"Found reference to API \"Tasks which have been registered previously with stored passwords must use the TaskFolder.RegisterTaskDefinition method for updates.\" (Indicator: \"RegisterTask\"; Source: \"sample.bin\"), Found reference to API \"Tasks which have been registered previously with stored passwords must use the TaskFolder.RegisterTaskDefinition method for updates.\" (Indicator: \"RegisterTaskDefinition\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053","id":"string-401","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains scheduled task related strings","description":"Found string \"/c schtasks /create /f /sc onlogon /rl highest /tn \"\" (Indicator: \"schtasks /create\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-128","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1055.011","id":"string-4","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$39","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to access crypto wallet extension (string)","description":"Found string \"ejbalbakoplchlghecdalmeeeajnimhm\" (Indicator: \"ejbalbakoplchlghecdalmeeeajnimhm\"; Source: \"sample.bin\"), Found string \"akoiaibnepcedcplijmiamnaigbepmcb\" (Indicator: \"akoiaibnepcedcplijmiamnaigbepmcb\"; Source: \"sample.bin\"), Found string \"ajkhoeiiokighlmdnlakpjfoobnjinie\" (Indicator: \"ajkhoeiiokighlmdnlakpjfoobnjinie\"; Source: \"sample.bin\"), Found string \"dfeccadlilpndjjohbjdblepmjeahlmm\" (Indicator: \"dfeccadlilpndjjohbjdblepmjeahlmm\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10066","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3b","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found Crypto currency wallets related strings","description":"Observed string: \"\\Coinomi\\Coinomi\\wallets\" (Indicator: \"\\coinomi\\coinomi\\wallets\") in Source: sample.bin, Observed string: \"\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb\" (Indicator: \"\\com.liberty.jaxx\\indexeddb\") in Source: sample.bin, Observed string: \"\\atomic\\Local Storage\\leveldb\" (Indicator: \"\\atomic\\local storage\") in Source: sample.bin, Observed string: \"\\Electrum\\wallets\" (Indicator: \"\\electrum\\wallets\") in Source: sample.bin, Observed string: \"\\Ethereum\\keystore\" (Indicator: \"\\ethereum\\keystore\") in Source: sample.bin, Observed string: \"\\Exodus\\exodus.wallet\" (Indicator: \"\\exodus\\exodus.wallet\") in Source: sample.bin, Observed string: \"\\Guarda\\Local Storage\\leveldb\" (Indicator: \"\\guarda\\local storage\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-100","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-129","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"Found string \"\\logins.json\" (Source: \"sample.bin\"), Found string \"logins.json\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"\\logins.json\" (Indicator: \"logins.json\"; in Source: \"sample.bin\"), Found string \"key3.db\" (Indicator: \"key3.db\"; in Source: \"sample.bin\"), Found string \"logins.json\" (Indicator: \"logins.json\"; in Source: \"sample.bin\"), Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-405","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$3c","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"\"\\Mozilla\\Firefox\\Profiles\\\" (Indicator: \"mozilla\\firefox\\\") in Source: sample.bin, \"\\Mozilla\\Firefox\\Profiles\\Waluigi\\parent.lock\" (Indicator: \"mozilla\\firefox\\\") in Source: sample.bin, \"\\Mozilla\\Firefox\\Profiles\" (Indicator: \"mozilla\\firefox\\\") in Source: sample.bin, \"\\Mozilla\\Firefox\\Profiles\\Waluigi\" (Indicator: \"mozilla\\firefox\\\") in Source: sample.bin, \"\\Google\\Chrome\\User Data\" (Indicator: \"google\\chrome\\user data\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-93","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Identified FTP credentials location strings","description":"\"sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: sample.bin, \"recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1552.001","id":"string-11","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve local system accounts","description":"file/memory contains long string with (Indicator: \"net user\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1087.001","id":"string-362","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"$3d","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-517","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system services using Tasklist","description":"$3e","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-173","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"\"\\TrustWallet\\Local Storage\\leveldb\" in Source: sample.bin, \"\\atomic\\Local Storage\\leveldb\" in Source: sample.bin, \"Discord\\Local Storage\\leveldb\" in Source: sample.bin, \"\\TronLink\\Local Storage\\leveldb\" in Source: sample.bin, \"Discord PTB\\Local Storage\\leveldb\" in Source: sample.bin, \"\\Guarda\\Local Storage\\leveldb\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-133","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found desktop apps credentials related location strings","description":"\"Discord\\Local Storage\\leveldb\" (Indicator: \"discord\\local storage\\\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-95","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser history information","description":"Found string \"\\places.sqlite\" (Indicator: \"places.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10069","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--remote-debugging-port={0} --headless=new --user-data-dir=\"{1}\" --disable-gpu --disable-logging\" (Indicator: \"--remote-debugging-port=\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-794","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system configuration","description":"Found string \"SystemInfo >> GetPublicIP : Request error\n\" (Indicator: \"systeminfo \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-359","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$3f","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://github.com/LimerBoy/StormKitty\" (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$40","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"Select * from Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"sample.bin\"), Found string \"SELECT ProcessId, Name, ExecutablePath FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"sample.bin\"), Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"sample.bin\"), Found string \"SELECT ExecutablePath, ProcessID FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-513","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"\\cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\"), Found string \"moz_cookies\" (Indicator: \"moz_cookies\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-5058","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"References Video COM interface string","description":"Found string \"{860BB310-5D01-11d0-BD3B-00A0C911CE86}\" (Indicator: \"{860bb310-5d01-11d0-bd3b-00a0c911ce86}\"; Source: \"sample.bin\"), Found string \"{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\" (Indicator: \"{62be5d10-60eb-11d0-bd3b-00a0c911ce86}\"; Source: \"sample.bin\"), Found string \"{55272A00-42CB-11CE-8135-00AA004BB851}\" (Indicator: \"{55272a00-42cb-11ce-8135-00aa004bb851}\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-757","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"file/memory contains long string with (Indicator: \"route PRINT\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-430","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"$41","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-432","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve local groups information","description":"file/memory contains long string with (Indicator: \"net localgroup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1069.001","id":"string-526","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"Discord >> SendMessage exception:\n\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"sendMessage\" (Indicator: \"sendmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set cdaudio door open\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"set CDAudio door closed\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\Description\\System\\CentralProcessor\\0\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-351","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"\\places.sqlite\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-662","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"6.0.9.0\", \"2.4.0.0\", Potential IP \"3.0.0.2\" found in string \"|3.0.0.2|\", \"4.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"SMTP Password2\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"Send-MailMessage -From '{0}' -Subject '{1}' -SmtpServer '{2}' -Encoding UTF8\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"SMTP User Name\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"SMTP Password\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"SMTP User\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"SMTP Server\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"SMTP Email Address\" (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://ipinfo.io/ip\", Pattern match: \"https://github.com/limerboy/stormkitty\", Pattern match: \"http://msdn.microsoft.com/en-us/library/windows/desktop/aa384138(v=vs.85).aspx\", Pattern match: \"http://james.newtonking.com/projects/json\", Heuristic match: \"system.data.sqlite.sr\", Heuristic match: \"ok.ru\", Pattern match: \"https://discordapp.com/api/v6/users/@me\", Heuristic match: \"settings.networksettings.id\", Pattern match: \"http://u@\", Pattern match: \"https://stackoverflow.com/q/11564914/23354\", Pattern match: \"https://discordapp.com/api/v6/users/@me/billing/payment-sources\", Heuristic match: \"vk.com\", Pattern match: \"https://discordapp.com/api/v6/users/@me/billing/subscriptions\", Pattern match: \"http://www.w3.org/2000/xmlns/\", Pattern match: \"http://schemas.microsoft.com/windows/2004/02/mit/task\", Heuristic match: \"\n*.sb\", Pattern match: \"https://stackoverflow.com/q/14436606/23354\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"\"http://ipinfo.io/ip\" (Indicator: \"ipinfo.io\"; File: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-56","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\", Found HTTPS url \"https://discordapp.com\", Found HTTPS url \"https://stackoverflow.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"Send-MailMessage -From '{0}' -Subject '{1}' -SmtpServer '{2}' -Encoding UTF8\" (Indicator: \"SmtpServer\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1505.002","id":"string-618","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 100 Continue\n\n\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"POST / HTTP/1.1\nHost: \" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to scan the ARP cache","description":"file/memory contains long string with (Indicator: \"arp -a\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-363","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Able to retrieve local network connections","description":"file/memory contains long string with (Indicator: \"netstat -an\"; Source: \"sample.bin\"), Found string \"NETSTAT\" (Indicator: \"netstat \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1049","id":"string-361","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"file/memory contains long string with (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1565","id":"string-479","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"$42","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-45","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"sample.bin\"), Found string \"\\mozglue.dll\" (Indicator: \"\\mozglue.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-493","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$43","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains asymmetric cryptographic functions (API string)","description":"Found reference to API \"BCrypt.BCryptDecrypt(): authentication tag mismatch\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() (get size) failed with status code: {0}\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() failed with status code:{0}\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.002","id":"string-398","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"BCrypt.BCryptDecrypt(): authentication tag mismatch\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt(): authentication tag mismatch\" (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() (get size) failed with status code: {0}\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() (get size) failed with status code: {0}\" (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptImportKey() failed with status code:{0}\" (Indicator: \"CryptImportKey\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() failed with status code:{0}\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() failed with status code:{0}\" (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCrypt.BCryptDecrypt(): authentication tag mismatch\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt(): authentication tag mismatch\" (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() (get size) failed with status code: {0}\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() (get size) failed with status code: {0}\" (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() failed with status code:{0}\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() failed with status code:{0}\" (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCrypt.BCryptDecrypt(): authentication tag mismatch\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() (get size) failed with status code: {0}\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptImportKey() failed with status code:{0}\" (Indicator: \"BCryptImportKey\"; Source: \"sample.bin\"), Found reference to API \"BCrypt.BCryptDecrypt() failed with status code:{0}\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-927","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a reference to the Stratum Mining Protocol","description":"\" -P stratum://\" (Indicator: \"stratum://\")","origin":"sample.bin","id":"string-54","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-231","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"Wow64GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"Wow64SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\"), Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\"), Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.012","id":"string-90","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1686","id":"string-676","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"file/memory contains long string with (Indicator: \"\\drivers\\\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"system32\\drivers\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to create local account","description":"file/memory contains long string with (Indicator: \"net user \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1136.001","id":"string-528","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"Windows\\explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\\\{0}\\root\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\"), Found string \"root\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281":{"type":"File","value":"40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat AsyncRAT"]},"filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections","filetype_short":"PE32"},"Threat:639898b8bf5cd6e74b685f8f697a73f2ab150abb6097b4d94a64992316f2111b":{"type":"Threat","value":"AsyncRAT","verdict":{"verdict":"malicious","verdict_source":"indicator database"}}},"chains":[{"id":"1569685474982972850","root":"File:40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat AsyncRAT"]}},{"id":"1569685459919119598","root":"File:40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281","edges":[{"edge_kind":"is_threat","from_key":"File:40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281","to_key":"Threat:639898b8bf5cd6e74b685f8f697a73f2ab150abb6097b4d94a64992316f2111b"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 40862d281bae… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 40862d281bae…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 40862d281bae… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 40862d281bae…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/40862d281baeb7297dfe659de2398f5afaadefd45d86a968653e79ccf6173281"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 40862d281bae… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 40862d281bae…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 19/25 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]] 32:null