34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 38:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious TR/Evo Sample 52c03b109064… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 52c03b109064…. Malware family: TR/Evo. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187","keywords":["Suspicious","TR/Evo","malware analysis","sandbox report","threat intelligence","52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187"],"about":{"@type":"SoftwareApplication","name":"52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187","applicationCategory":["pedll","executable"],"identifier":"52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"TR/Evo","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T14a2,"UPDATE sys_user SET Pwd=@Pwd,PwdEncode=@Encoding,UpdateTime=@Now WHERE Id=@Id AND Pwd=@OldPwd AND State=1 AND (IsDeleted IS NULL OR IsDeleted=0)" (Source: sample.bin, Indicator: "update sys_user set pwd=@pwd,pwdencode=@encoding,updatetime=@now where id=@id and pwd=@oldpwd and state=1 and (isdeleted is null or isdeleted=0)"), "SELECT Jobs FROM sys_user WHERE Id=@u" (Source: sample.bin, Indicator: "select jobs from sys_user where id=@u"), "SELECT * FROM "diy_table" WHERE "IsDeleted" <> 1 AND ("Id" = @p0 OR LOWER("Name") = LOWER(@p0)) LIMIT 1" (Source: sample.bin, Indicator: "select * from "diy_table" where "isdeleted" <> 1 and ("id" = @p0 or lower("name") = lower(@p0)) limit 1"), "DELETE FROM `mci_network_traffic_rollup` WHERE (`BucketMinutes`=5 AND `BucketStartUtc`<@fiveMinuteCutoff) OR (`BucketMinutes`=60 AND `BucketStartUtc`<@hourlyCutoff) OR (`BucketMinutes`=1440 AND `BucketStartUtc`<@dailyCutoff) OR (`IsDeleted`=1 AND `UpdateTime`<@deletedCutoff)" (Source: sample.bin, Indicator: "delete from `mci_network_traffic_rollup` where (`bucketminutes`=5 and `bucketstartutc`<@fiveminutecutoff) or (`bucketminutes`=60 and `bucketstartutc`<@hourlycutoff) or (`bucketminutes`=1440 and `bucketstartutc`<@dailycutoff) or (`isdeleted`=1 and `updatetime`<@deletedcutoff)"), "select * from {0}sys_config{1} " (Source: sample.bin, Indicator: "select * from {0}sys_config{1} "), "SELECT RuleJson FROM mci_platform_reminder WHERE ReminderType='LicenseExpiry' AND ScopeType=@scope AND Status='Published' AND IsDeleted<>1" (Source: sample.bin, Indicator: "select rulejson from mci_platform_reminder where remindertype='licenseexpiry' and scopetype=@scope and status='published' and isdeleted<>1"), "SELECT COUNT(Id) FROM {0} WHERE {1}={2}{3} AND {4}<>'' AND {5} IS NOT NULL AND IsDeleted <> 1{6}" (Source: sample.bin, Indicator: "select count(id) from {0} where {1}={2}{3} and {4}<>'' and {5} is not null and isdeleted <> 1{6}"), "SELECT COUNT(Id) FROM " (Source: sample.bin, Indicator: "select count(id) from "), "SELECT b.Id,b.State,b.SnapshotJson FROM mci_platform_reminder_batch b WHERE b.IsDeleted<>1 AND b.State='Published' AND b.ScopeType='Tenants' AND b.EndsAt>@now AND EXISTS (SELECT 1 FROM mci_platform_reminder_target t WHERE t.BatchId=b.Id AND t.IsDeleted<>1 AND (t.TargetKey=@tenant OR t.TargetKey='*')) ORDER BY b.Id" (Source: sample.bin, Indicator: "select b.id,b.state,b.snapshotjson from mci_platform_reminder_batch b where b.isdeleted<>1 and b.state='published' and b.scopetype='tenants' and b.endsat>@now and exists (select 1 from mci_platform_reminder_target t where t.batchid=b.id and t.isdeleted<>1 and (t.targetkey=@tenant or t.targetkey='*')) order by b.id"), "INSERT INTO `mci_network_traffic_rollup` (`Id`, `CreateTime`, `UpdateTime`, `IsDeleted`, `BucketStartUtc`, `BucketMinutes`, `NodeId`, `ObservedOsClient`, `DimensionType`, `DimensionKey`, `DimensionKeyHash`, `RequestCount`, `ErrorCount`, `SlowCount`, `ReceivedBytes`, `SentBytes`, `TotalBytes`, `DurationMs`, `MaxDurationMs`, `AnonymousCount`, `UploadCount`, `DownloadCount`, `SuspiciousCount`, `RiskLevel`, `LastSeenAtUtc`) VALUES (@Id, @CreateTime, @UpdateTime, @IsDeleted, @BucketStartUtc, @BucketMinutes, @NodeId, @ObservedOsClient, @DimensionType, @DimensionKey, @DimensionKeyHash, @RequestCount, @ErrorCount, @SlowCount, @ReceivedBytes, @SentBytes, @TotalBytes, @DurationMs, @MaxDurationMs, @AnonymousCount, @UploadCount, @DownloadCount, @SuspiciousCount, @RiskLevel, @LastSeenAtUtc)" (Source: sample.bin, Indicator: "insert into `mci_network_traffic_rollup` (`id`, `createtime`, `updatetime`, `isdeleted`, `bucketstartutc`, `bucketminutes`, `nodeid`, `observedosclient`, `dimensiontype`, `dimensionkey`, `dimensionkeyhash`, `requestcount`, `errorcount`, `slowcount`, `receivedbytes`, `sentbytes`, `totalbytes`, `durationms`, `maxdurationms`, `anonymouscount`, `uploadcount`, `downloadcount`, `suspiciouscount`, `risklevel`, `lastseenatutc`) values (@id, @createtime, @updatetime, @isdeleted, @bucketstartutc, @bucketminutes, @nodeid, @observedosclient, @dimensiontype, @dimensionkey, @dimensionkeyhash, @requestcount, @errorcount, @slowcount, @receivedbytes, @sentbytes, @totalbytes, @durationms, @maxdurationms, @anonymouscount, @uploadcount, @downloadcount, @suspiciouscount, @risklevel, @lastseenatutc)"), "SELECT Id, DiyTableId, FieldPermissions FROM sys_menu WHERE (IsDeleted=0 OR IsDeleted IS NULL) AND FieldPermissions IS NOT NULL AND FieldPermissions <> ''" (Source: sample.bin, Indicator: "select id, diytableid, fieldpermissions from sys_menu where (isdeleted=0 or isdeleted is null) and fieldpermissions is not null and fieldpermissions <> ''"), "SELECT ApiEngineKey,IsEnable,StopHttp FROM sys_apiengine WHERE ApiEngineKey=@key AND (IsDeleted<>1 OR IsDeleted IS NULL)" (Source: sample.bin, Indicator: "select apienginekey,isenable,stophttp from sys_apiengine where apienginekey=@key and (isdeleted<>1 or isdeleted is null)"), "SELECT Id,ConfigKey,ConfigValue,SecretCipher,IsSecret,IsEnabled FROM mci_system_setting WHERE ConfigKey=@key AND (IsDeleted<>1 OR IsDeleted IS NULL)" (Source: sample.bin, Indicator: "select id,configkey,configvalue,secretcipher,issecret,isenabled from mci_system_setting where configkey=@key and (isdeleted<>1 or isdeleted is null)")37:T41c,Pattern match: "https://api.microi.net/apiengine/check-license?osclient=itdos", Heuristic match: "microi.net", Pattern match: "https://api.microi.net", Heuristic match: "+*.si", Pattern match: "https://openapi.alipay.com/gateway.do", Pattern match: "https://api.microi.net/apiengine/platform-reminder-official-feed?osclient=itdos", Heuristic match: "copyright 2009-2026 microi.net", Heuristic match: "select b.id,b.state,b.snapshotjson from mci_platform_reminder_batch b where b.isdeleted<>1 and b.state='published' and b.scopetype='tenants' and b.endsat>@now and exists (select 1 from mci_platform_reminder_target t where t.batchid=b.id and t.isdeleted<>1 ", Pattern match: "https://api.microi.net/apiengine/platform-reminder-official-feed?osclient=itdos&edition=", Pattern match: "kc.br/}jtc", Heuristic match: "u[-{a+ji.bs", Pattern match: "https://microi.net", Heuristic match: "wx.tenpay.com", Heuristic match: " *.sk", Heuristic match: " *.sm", Heuristic match: " *.sd", Heuristic match: "cu,^@.tk", Pattern match: "https://api.mch.weixin.qq.com"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1794615471963,"unified_at":"2026-11-14T00:17:51.963Z","metadata":{"hashes":{"sha256":"52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187","sha1":"b6b07e268c00b6bda9f318b4994297f8d3ef87bb","md5":"3aa38a8715ba369c258f82251d5670a9"},"file_info":{"file_name":"52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187","file_type":["pedll","executable"],"file_type_id":"dll","file_size":3405312,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794615464000,"last_seen":1794615464000,"last_multi_scan":1794615464000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":12,"suspicious_count":1,"malicious_count":0,"total":13},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TR/Evo","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Possibly contains Public/Private key (encryption)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to query volume/memory size (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains SQL queries","description":"$36","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Tencent\" (Indicator: \"tencent\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://api.microi.net\", Found HTTPS url \"https://openapi.alipay.com\", Found HTTPS url \"https://microi.net\", Found HTTPS url \"https://api.mch.weixin.qq.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"9.0.5.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM \"diy_table\"\nWHERE \"IsDeleted\" <> 1\n AND (\"Id\" = @p0 OR LOWER(\"Name\") = LOWER(@p0))\nLIMIT 1\" (Indicator: \"select * from \"; Source: \"sample.bin\"), Found string \"select * from {0}sys_config{1} \" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"WindowsGlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"sample.bin\"), Found reference to API \"WindowsGlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"RSA2\" (Indicator: \"rsa2\"; Source: \"sample.bin\"), Found string \"Base64ToString\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"BodyBase64\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"WECHATPAY2-SHA256-RSA2048 mchid=\"\" (Indicator: \"rsa2\"; Source: \"sample.bin\"), Found string \"_FilesByteBase64\" (Indicator: \"base64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where {0}IsEnable{1}=1 \" (Indicator: \"where \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - V8\\s*\\.\\s*FormEngine\\s*\\.\\s*(AddFormData|AddTableData|UptFormData|UptTableData|UptFormDataByWhere|DelFormData|DelTableData|DelFormDataByWhere)\\s*\\(; Source: \"sample.bin\"), Found string - V8\\s*\\.\\s*MongoDb\\s*\\.\\s*(AddFormData|UptFormData|DelFormData)\\s*\\(|V8\\s*\\.\\s*Method\\s*\\.\\s*Upload\\s*\\(|\\.\\s*ExecuteNonQuery\\s*\\(|\\b(insert\\s+into|replace\\s+into|update\\s+[`\\w]+\\s+set|delete\\s+from|merge\\s+into|create\\s+table|alter\\s+table|drop\\s+table)\\b; Source: \"sample.bin\"), Found string - \\A\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{1,7})?(?:Z|[+-]\\d{2}:\\d{2})\\z; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"1cF>RC2Kv8lZ\" (Indicator: \"RC2\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"RSA PUBLIC KEY\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"PUBLIC KEY\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"-----BEGIN PUBLIC KEY-----\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"-----BEGIN RSA PUBLIC KEY-----\" (Indicator: \"public key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Cryptographic Related","name":"Possibly contains Public/Private key (encryption)","description":"\"-----BEGIN PUBLIC KEY-----\" (Indicator: \"----begin public key----\") in Source: sample.bin, \"-----BEGIN RSA PUBLIC KEY-----\" (Indicator: \"----begin rsa public key----\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1560","id":"string-68","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187":{"type":"File","value":"52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187","verdict":{"verdict":"suspicious","verdict_source":"static file analysis engine","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable for MS Windows 4.00 (DLL), Intel i386 Mono/.Net assembly, 5 sections","filetype_short":"PE32"}},"chains":[{"id":"1570955882455532599","root":"File:52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"static file analysis engine","reasons":["Associated with known suspicious activity"]}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Suspicious TR/Evo Sample 52c03b109064… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 52c03b109064…. Malware family: TR/Evo. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187"}],["$","meta","4",{"property":"og:title","content":"Suspicious TR/Evo Sample 52c03b109064… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 52c03b109064…. Malware family: TR/Evo. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/52c03b10906448571d05b8b15899a13240c712f5560e7abe5f529898ddeb1187"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious TR/Evo Sample 52c03b109064… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 52c03b109064…. Malware family: TR/Evo. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]] 32:null