24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.CryptConsole.Generic Sample 41c468fb9e78… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 41c468fb9e78…. Malware family: Ransom.CryptConsole.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651","keywords":["Malicious","Ransom.CryptConsole.Generic","malware analysis","sandbox report","threat intelligence","41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651"],"about":{"@type":"SoftwareApplication","name":"41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.CryptConsole.Generic","antivirusDetections":{"malicious":19,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4d1,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin" Observed namespace "System.Runtime.InteropServices.MarshalAsAttribute" and TypeReference ".ctor" in "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin"26:T5a4,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "41c468fb9e78af077ad9232e2ad9bcd3df1444fd85e589f77d7314e05fd59651.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00008188.00000000.152884.00F72000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00008188.00000000.152884.00F72000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00008188.00000000.152884.00F72000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00008188.00000000.152884.00F72000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00008188.00000000.152884.00F72000.00000002.mdmp")27:T4f1,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Able to perform cryptographic operations Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: YARA signature match - AES encryption Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Dotnet file contains encryption/decryption functions28:T43d,Found string "get_UserName" (Source: "00000000-00008188.00000000.152884.00F72000.00000002.mdmp") Found string "get_OSVersion" (Source: "00000000-00008188.00000000.152884.00F72000.00000002.mdmp") Found string "get_Is64BitOperatingSystem" (Source: "00000000-00008188.00000000.152884.00F72000.00000002.mdmp") Found string "get_MachineName" (Source: "00000000-00008188.00000000.152884.00F72000.00000002.mdmp") Found string "GetDrives" (Source: "00000000-00008188.00000000.152884.00F72000.00000002.mdmp") Found string "UserName" (Source: "00000000-00008188.00000000.152884.05500000.00000004.mdmp, 00000000-00008188.00000000.152884.1E3D0000.00000004.mdmp") Found string "etUserNameA" (Source: "00000000-00008188.00000000.152884.1E3D0000.00000004.mdmp") Found string "etUserNameExW" (Source: "00000000-00008188.00000000.152884.1E3D0000.00000004.mdmp") Found string "etUserNameExA" (Source: "00000000-00008188.00000000.152884.1E3D0000.00000004.mdmp") Found string "Win32API|System Information Functions|GetUserName" (Source: "00000000-00008188.00000000.152884.1E3D0000.00000004.mdmp")29:T775,"