26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ad,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.ZitirezC.Generic Sample 5168d5d6b59a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5168d5d6b59a…. Malware family: Mint.ZitirezC.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0","keywords":["Malicious","Mint.ZitirezC.Generic","malware analysis","sandbox report","threat intelligence","5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0"],"about":{"@type":"SoftwareApplication","name":"bounty-76815814295691646","applicationCategory":["peexe","executable"],"identifier":"5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.ZitirezC.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4c2,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002716.00000000.158669.04640000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002716.00000000.158669.04640000.00000040.mdmp") Found string "!"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002716.00000000.158669.04640000.00000040.mdmp"), Found string "!"#$%&'()*+ -./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002716.00000000.158669.04640000.00000040.mdmp")28:T5db,Assembly shows XOR instruction xor eax ebp in Stream UID: 12284-489-0040C5CF Assembly shows XOR instruction xor ecx ebp in Stream UID: 12284-489-0040C5CF Assembly shows XOR instruction xor eax ebp in Stream UID: 12284-491-0040C31F Assembly shows XOR instruction xor ecx ebp in Stream UID: 12284-491-0040C31F Assembly shows XOR instruction xor eax ebp in Stream UID: 12284-745-004099A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 12284-745-004099A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 12284-746-00410EBD Assembly shows XOR instruction xor ecx ebp in Stream UID: 12284-746-00410EBD Assembly shows XOR instruction xor eax ebp in Stream UID: 12284-748-00417B42 Assembly shows XOR instruction xor ecx ebp in Stream UID: 12284-748-00417B42 Assembly shows XOR instruction xor eax ebp in Stream UID: 12284-774-0040EEB8 Assembly shows XOR instruction xor ecx ebx in Stream UID: 12284-774-0040EEB8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 12284-774-0040EEB8 Assembly shows XOR instruction xor eax ebp in Stream UID: 12284-800-004137AF Assembly shows XOR instruction xor ecx ebp in Stream UID: 12284-800-004137AF Assembly shows XOR instruction xor eax ebp in Stream UID: 12284-803-004138B1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 12284-803-004138B1 Assembly shows XOR instruction xor eax ebp in Stream UID: 12284-807-00413A82 Assembly shows XOR instruction xor ecx ebp in Stream UID: 12284-807-00413A8229:T4f8,"" (Indicator: "GetDC"; Source: "00000000-00002716.00000000.158669.046A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002716.00000000.158669.046A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002716.00000000.158669.046A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002716.00000000.158669.046A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002716.00000000.158669.046A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002716.00000000.158669.046A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002716.00000000.158669.046A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002716.00000000.158669.046A0000.00000004.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00002716.00000000.158669.061D0000.00000004.mdmp")31:T43e,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002716.00000000.158669.061D0000.00000004.mdmp")32:T867,Found string "system" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: MSVCR100.DLL) Found string "FlsFree" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: KERNELBASE.DLL) Found string "floor" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: MSVCR100.DLL) Found string "log10" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: MSVCR100.DLL) Found string "frexp" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: MSVCR100.DLL) Found string "ldexp" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: MSVCR100.DLL) Found string "atan2" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: MSVCR100.DLL) Found string "GetProcessWindowStation" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: USER32.DLL) Found string "GetUserObjectInformationW" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: USER32.DLL) Found string "MessageBoxW" (Source: 5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin, API is part of module: USER32.DLL)33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3dwAAAAAAAAAAAAAAd3d3AAAAAAAAAAAAd3d3d3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3AAAAAHd3d3d3d3d3d3d3dwAAAAd3d3d3d3d3d3d3d3cAAAB3d3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAD////////+H///gf//gAAB/wAAAf4AAAH8AAAB+AAAAfAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAHgAAAB4AAAAeAAAAEAAAAB4AAAAeAAAAHgAAAB/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791202730574,"unified_at":"2026-10-05T12:18:50.574Z","metadata":{"hashes":{"sha256":"5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0","sha1":"5711732de88e477176787e1db168988479119331","md5":"aee08a1125541dfc8023ced782c61f5f","sha512":"326502281c6455c9e363cf266ccb514d93ae07b6084fc158a38a81ea56dd7d4210430b25c783727ed64183511ae678f5ab16b250200f05be3f22c562b36b5937","ssdeep":"3072:TzLoQaKk1daJj1MMjuqfFhNxlwfF7cQKhpPHrPsGkobjrVPfWD:XchuJ7juqf7Nv8qPHzPkw3A","ssdeep_chunks":["3072:TzLoQaK","3072:zLoQaKk","3072:LoQaKk1","3072:oQaKk1d","3072:QaKk1da","3072:aKk1daJ","3072:Kk1daJj","3072:k1daJj1","3072:1daJj1M","3072:daJj1MM","3072:aJj1MMj","3072:Jj1MMju","3072:j1MMjuq","3072:1MMjuqf","3072:MMjuqfF","3072:MjuqfFh","3072:juqfFhN","3072:uqfFhNx","3072:qfFhNxl","3072:fFhNxlw","3072:FhNxlwf","3072:hNxlwfF","3072:NxlwfF7","3072:xlwfF7c","3072:lwfF7cQ","3072:wfF7cQK","3072:fF7cQKh","3072:F7cQKhp","3072:7cQKhpP","3072:cQKhpPH","3072:QKhpPHr","3072:KhpPHrP","3072:hpPHrPs","3072:pPHrPsG","3072:PHrPsGk","3072:HrPsGko","3072:rPsGkob","3072:PsGkobj","3072:sGkobjr","3072:GkobjrV","3072:kobjrVP","3072:objrVPf","3072:bjrVPfW","3072:jrVPfWD","6144:TzLoQaK","6144:zLoQaKk","6144:LoQaKk1","6144:oQaKk1d","6144:QaKk1da","6144:aKk1daJ","6144:Kk1daJj","6144:k1daJj1","6144:1daJj1M","6144:daJj1MM","6144:aJj1MMj","6144:Jj1MMju","6144:j1MMjuq","6144:1MMjuqf","6144:MMjuqfF","6144:MjuqfFh","6144:juqfFhN","6144:uqfFhNx","6144:qfFhNxl","6144:fFhNxlw","6144:FhNxlwf","6144:hNxlwfF","6144:NxlwfF7","6144:xlwfF7c","6144:lwfF7cQ","6144:wfF7cQK","6144:fF7cQKh","6144:F7cQKhp","6144:7cQKhpP","6144:cQKhpPH","6144:QKhpPHr","6144:KhpPHrP","6144:hpPHrPs","6144:pPHrPsG","6144:PHrPsGk","6144:HrPsGko","6144:rPsGkob","6144:PsGkobj","6144:sGkobjr","6144:GkobjrV","6144:kobjrVP","6144:objrVPf","6144:bjrVPfW","6144:jrVPfWD","3072:XchuJ7j","3072:chuJ7ju","3072:huJ7juq","3072:uJ7juqf","3072:J7juqf7","3072:7juqf7N","3072:juqf7Nv","3072:uqf7Nv8","3072:qf7Nv8q","3072:f7Nv8qP","3072:7Nv8qPH","3072:Nv8qPHz","3072:v8qPHzP","3072:8qPHzPk","3072:qPHzPkw","3072:PHzPkw3","3072:HzPkw3A"],"imphash":"927e8ee399146237468353308c6002fe"},"file_info":{"file_name":"bounty-76815814295691646","file_type":["peexe","executable"],"file_type_id":"exe","file_size":275456,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1694022531000,"last_seen":1774021675000,"last_multi_scan":1774021675000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","criminal","informationstealer","stealc","downloader"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":44},"sandbox_signatures":{"informative_count":104,"suspicious_count":5,"malicious_count":3,"total":112},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Convagent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1366041","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.ZitirezC.qm0@dCIZsinasd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.ZitirezC.qm0@dCIZsinasd (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HUNU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.STOP.bot!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a60081 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-VK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Packed-GDV12!AEE08A112554","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.KMY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.SZW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_64.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Stealerc.Win32.20037","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Mint.ZitirezC.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Able to access mailslot-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/read/set mailslotinfo (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Imports mailslot-related APIs"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Able to perform anti-VM checks using CPUID"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002716.00000000.158669.061D0000.00000004.mdmp\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002716.00000000.158669.061D0000.00000004.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00002716.00000000.158669.061D0000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002716.00000000.158669.061D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002716.00000000.158669.061D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"5168d5d6b59a26403a898e2d652325da96692f58353fa0105ca90cbb536138a0.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002716.00000000.158669.061D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002716.00000000.158669.046A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"bugF8DaHflC/AesdtISkeCN8Ri782v9EL6jnXbyly7rE5QayQRrMxx2BNs4sQA==\" (Indicator: \"Aes\"; Source: \"00000000-00002716.00000000.158669.04640000.00000040.mdmp\")\n Found reference to \"OAes\" (Indicator: \"Aes\"; Source: \"00000000-00002716.00000000.158669.046C9000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002716.00000000.158669.04640000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002716.00000000.158669.046C9000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002716.00000000.158669.046A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69bd6c21567f56844d019624"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"