26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample 40d8a88490a6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 40d8a88490a6…. Malware family: Yogi.Generic. Threat score 100/100. 11/28 AV engines flagged this file. 6 malicious and 34 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30"],"about":{"@type":"SoftwareApplication","name":"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":34},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T965,Found string "Bitmap with unknown compression (%d)" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "Bitmap with unsupported compression (%s)" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "Bitmap with wrong combination of bit count (%d) and compression (%s)" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "Bad BMP compression mode" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "Can't use RLE compression with" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "compression" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "inflate decompression failed, because not enough space" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "deflate compression failed, because not enough space" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "no compression" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "Tcompressionstream" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "Tdecompressionstream" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "Ecompressionerror" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "Edecompressionerror" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "Tcompressionstream0" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "unknown compression method" (Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found string "The WS-Management service does not support the specified compression scheme (%1)." (Source: "00000000-00005780.00000000.232819.08600000.00000002.mdmp") Found string "The only supported compression type is "xpress"." (Source: "00000000-00005780.00000000.232819.08600000.00000002.mdmp") Found string "The WinRM client cannot process the request. The request contained the compression option but contained an unrecognized value." (Source: "00000000-00005780.00000000.232819.08600000.00000002.mdmp") Found string "Change the value for the compression option and try the request again." (Source: "00000000-00005780.00000000.232819.08600000.00000002.mdmp")28:T649,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005780.00000000.232819.00398000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005780.00000000.232819.00398000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005780.00000000.232819.00398000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005780.00000000.232819.00398000.00000004.mdmp")29:T66f,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin") Found reference to API "[TWin32WidgetSet.AppProcessMessages] MsgWaitForMultipleObjects returned:" (Indicator: "WaitForMultipleObjects"; File: "40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found reference to API "[TWin32WidgetSet.AppProcessMessages] MsgWaitForMultipleObjects returned:" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005780.00000000.232819.0025B000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005780.00000000.232819.00398000.00000004.mdmp")2a:T757,"\" (Source: \"00000000-00005780.00000000.232819.08600000.00000002.mdmp\")\n Found string \"providerFilter=Yes VPN.UserName=\"UserXXX\"\" (Source: \"00000000-00005780.00000000.232819.08600000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005780.00000000.232819.0025B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found string \"EnumServicesStatusExW\" (File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005780.00000000.232819.0025B000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00005780.00000000.232819.0025B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\": No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions\" (Source: \"00000000-00005780.00000000.232819.08600000.00000002.mdmp\")\n Found string \"Outlook Attachment\" (Source: \"00000000-00005780.00000000.232819.08600000.00000002.mdmp\")\n Found string \"Attachments:[To modify indexing settings on another user's mail folder, that user needs to be logged in.HIndexing of Outlook email has been disabled by the System Administrator.HIndexing of Offline files has been disabled by the System Administrator.\" (Source: \"00000000-00005780.00000000.232819.08600000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"40d8a88490a6c1a847de73aaf34d9bf440e98232e6f568bd33ceaf77a0b15a30.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005780.00000000.232819.00398000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a4c68fa24676654b904e4b5"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"