34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 42:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4e7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware.GSLc.Generic Sample 4ebe1f0f988f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4ebe1f0f988f…. Malware family: Malware.GSLc.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db","keywords":["Malicious","Malware.GSLc.Generic","malware analysis","sandbox report","threat intelligence","4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db"],"about":{"@type":"SoftwareApplication","name":"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware.GSLc.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T930,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ReadAllLines" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SELECT host_key, name, encrypted_value FROM cookies" (Indicator: "select"; Source: "sample.bin"), Found reference to API "SetStateMachine" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "System.Runtime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "WriteAllText" (Indicator: "write"; Source: "sample.bin"), Found reference to API "PostAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "AsyncCallback" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "AsyncTaskMethodBuilder`1" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "Clipboard access requires STA thread." (Indicator: "access"; Source: "sample.bin"), Found reference to API "Clipboard access requires STA thread." (Indicator: "read"; Source: "sample.bin"), Found reference to API "CreateSubKey" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "ReadToEndAsync" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadToEndAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "StreamReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ExecuteReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ThreadStart" (Indicator: "read"; Source: "sample.bin"), Found reference to API "get_HasExited" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "WriteInt32" (Indicator: "write"; Source: "sample.bin"), Found reference to API "ReadInt32" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SQLiteConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "b__0" (Indicator: "kill"; Source: "sample.bin"), Found reference to API "drivers.Program+d__83" (Indicator: "shutdown"; Source: "sample.bin"), Found reference to API "Killed PID " (Indicator: "kill"; Source: "sample.bin"), Found reference to API "/status" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "stateMachine" (Indicator: "stat"; Source: "sample.bin")37:T689,Found reference to API (Indicator: "DispatchMessage"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfo"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleWindow"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "Local State"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessage"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CallNextHookEx"; Source: "sample.bin")38:T775,"d__100\" (Indicator: \"EncryptFile\"; Source: \"sample.bin\"), Found reference to API \"d__101\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\"), Found reference to API \"$drivers.Program+d__101\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\"), Found reference to API \"DecryptFiles\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\"), Found reference to API \"$drivers.Program+d__100\" (Indicator: \"EncryptFile\"; Source: \"sample.bin\"), Found reference to API \"EncryptFiles\" (Indicator: \"EncryptFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"d__101\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\"), Found reference to API \"$drivers.Program+d__101\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\"), Found reference to API \"DecryptFiles\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.AesGcm.DecryptBrowserData\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-445","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"000569\" (Indicator: \"000569\"), \"080027\" (Indicator: \"080027\"), \"005056\" (Indicator: \"005056\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-2","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system configuration","description":"Found string \"SystemInfo\" (Indicator: \"systeminfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-359","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT SerialNumber FROM Win32_LogicalDisk WHERE DeviceID='C:'\" (Indicator: \" win32_logicaldisk\"; Source: \"sample.bin\"), \"SELECT SerialNumber FROM Win32_BaseBoard\" (Indicator: \" win32_baseboard\"; Source: \"sample.bin\"), \"SELECT ProcessorId FROM Win32_Processor\" (Indicator: \" win32_process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT ProcessorId FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-513","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"C:\\Users\\mpcon\\Downloads\\drivers\\obj\\Release\\net8.0-windows\\win-x64\\WindowsDriverUpdate.pdb\" (Indicator: \"\\drivers\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-91","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://api.telegram.org/bot\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://api.telegram.org\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"https://api.telegram.org/bot\" (Indicator: \"api.telegram.org\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1499","id":"string-221","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"logins.json\" (Indicator: \"logins.json\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-405","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"System.IO.Compression.ZipFile\" (Source: \"00000000-00008668.00000001.129032.ECD12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db.bin\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"ReadInt32\" in \"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db.bin\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"AllocHGlobal\" in \"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db.bin\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"WriteInt32\" in \"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db.bin\"\n Observed namespace \"System.Runtime.InteropServices.Marshal\" and TypeReference \"FreeHGlobal\" in \"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.ZipFile\" in \"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db.bin\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00008668.00000000.128751.ECED0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00008668.00000001.129032.ECD12000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00008668.00000001.129032.ECD12000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"d__67>(drivers.Program/d__67&) at cc9be3b55bd7d28797f1a5071c334308-6000023-Program~BotListener\n drivers.Program::BotListener(System.Threading.CancellationToken) at cc9be3b55bd7d28797f1a5071c334308-600006e-Programc~Mainb__52_0\n System.Runtime.CompilerServices.AsyncTaskMethodBuilder::AwaitUnsafeOnCompleted\ndrivers.Program/d__67>(System.Runtime.CompilerServices.TaskAwaiter`1&,drivers.Program/d__67&) at cc9be3b55bd7d28797f1a5071c334308-600008f-ProgramBotListenerd__67~MoveNext","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Runtime.CompilerServices.AsyncTaskMethodBuilder::Startd__67>(drivers.Program/d__67&) at cc9be3b55bd7d28797f1a5071c334308-6000023-Program~BotListener\n drivers.Program::BotListener(System.Threading.CancellationToken) at cc9be3b55bd7d28797f1a5071c334308-600006e-Programc~Mainb__52_0\n System.Runtime.CompilerServices.AsyncTaskMethodBuilder::AwaitUnsafeOnCompleted\ndrivers.Program/d__67>(System.Runtime.CompilerServices.TaskAwaiter`1&,drivers.Program/d__67&) at cc9be3b55bd7d28797f1a5071c334308-600008f-ProgramBotListenerd__67~MoveNext\n Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfo::Create(Microsoft.CSharp.RuntimeBinder.CSharpArgumentInfoFlags,System.String) at cc9be3b55bd7d28797f1a5071c334308-60000fd-ProgramWebcamd__92~MoveNext","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Able to reboot/shutdown the operating system","description":"drivers.Program::ExitWindowsEx(System.Int32,System.Int32) at cc9be3b55bd7d28797f1a5071c334308-60000b7-ProgramLogoffd__85~MoveNext","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains ability to simulate user keyboard/mouse input","description":"drivers.Program::mouse_event(System.UInt32,System.UInt32,System.UInt32,System.UInt32,System.Int32) at cc9be3b55bd7d28797f1a5071c334308-60000b9-ProgramMouseClickd__98~MoveNext","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056","relevance":6,"id":"stream-35","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db.bin\" claims program is from Thu Feb 17 09:10:33 2084","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/26 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"May attempt to implement anti-virtualization techniques using MAC address detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Able to check if a debugger is running"}],"sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":38,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["infostealer","evasive"],"sample_flags":["Sample Crashed"],"sandbox_reports":[{"id":"6af3189400fa4619320fe7cd","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL.BypassUAC","submit_name":"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db.bin","analysis_start_time":"2026-11-10T13:13:57+00:00","indicators_count":{"informative":124,"suspicious":27,"malicious":4},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}],"processes":[{"pid":8668,"ppid":0,"name":"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db.bin.exe","command_line":"","sha256":"4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db","normalized_path":"C:\\4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db.bin.exe","uid":"00000000-00008668","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":8392,"ppid":8668,"name":"WerFault.exe","command_line":"-u -p 8668 -s 796","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008668","uid":"00000000-00008392"},{"pid":6292,"ppid":8668,"name":"WerFault.exe","command_line":"-u -p 8668 -s 796","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00008668","uid":"00000000-00006292"},{"pid":7680,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 8668 -ip 8668","sha256":"97448c6ae59a389e0aec5c62ccef112be44d5f648568680dc83962102f8475af","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00007680","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["vcruntime140.dll","vcruntime140_1.dll","msvcrt.dll","version.dll","ntdll.dll","apphelp.dll","user32.dll","imm32.dll","sechost.dll","kernel.appcore.dll","ucrtbase_clr0400.dll","advapi32.dll","oleaut32.dll","mscoreei.dll","psapi.dll","shlwapi.dll","mscoree.dll","KernelBase.dll","win32u.dll","vcruntime140_clr0400.dll","uxtheme.dll","msvcp140.dll","ole32.dll","combase.dll","bcryptprimitives.dll","gdi32.dll","fltLib.dll","clr.dll","mscorlib.ni.dll","kernel32.dll","VxSSL64.dll","ws2_32.dll","rpcrt4.dll","gdi32full.dll","bcrypt.dll","cryptsp.dll","ucrtbase.dll","msvcp_win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]},{"name":"SM0:8668:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af3189400fa4619320fe7cd"}]}]}},"report_ids":{"sandbox_job_ids":["6af3189400fa4619320fe7cd"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Malware.GSLc.Generic Sample 4ebe1f0f988f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4ebe1f0f988f…. Malware family: Malware.GSLc.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware.GSLc.Generic Sample 4ebe1f0f988f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4ebe1f0f988f…. Malware family: Malware.GSLc.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4ebe1f0f988fd1b5dc35eeb43e863903ed41d63b45ac07e9a936369adebb90db"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware.GSLc.Generic Sample 4ebe1f0f988f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4ebe1f0f988f…. Malware family: Malware.GSLc.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]] 32:null