34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3e:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4b1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Keylogger.2.Generic Sample 5d2a4cde9fa7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5d2a4cde9fa7…. Malware family: Keylogger.2.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","keywords":["Malicious","Keylogger.2.Generic","malware analysis","sandbox report","threat intelligence","5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16"],"about":{"@type":"SoftwareApplication","name":"7961c2cd-4b9f-4c13-a937-78bc295a4752","applicationCategory":["pedll","executable"],"identifier":"5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Keylogger.2.Generic","antivirusDetections":{"malicious":17,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Tb3b,Found string "HTTP/1.1 403 Access Forbidden Server: %s/%s Date: %s Connection: close Content-Type: text/html Content-Length: %d %s" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "HTTP/1.1 200" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "HTTP/1.1 200 OK Server: %s/%s Date: %s %sContent-Type: %s Accept-Ranges: bytes Last-Modified: %s ETag: "%s" Content-Length: %I64d " (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "HTTP/1.1 404 Object Not Found Server: %s/%s Date: %s Connection: close Content-Type: text/html Content-Length: %d %s" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "Requested Range Not Satisfiable
HTTP/1.1 416 Requested Range Not Satisfiable

" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "GET /%s HTTP/1.0 Host:%s Connection: keep-alive " (Indicator: "HTTP/1.0"; Source: "sample.bin"), Found string "HTTP/1.0 200" (Indicator: "HTTP/1.0"; Source: "sample.bin"), Found string "HTTP/1.1 416 Requested Range Not Satisfiable Server: %s/%s Date: %s Connection: close Content-Range: bytes */%I64d Content-Type: text/html Content-Length: %d %s" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "HTTP/1.1 304 Not Modified Server: %s/%s Date: %s ETag: "%s" Content-Length: %d " (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "HTTP/1.1 200 OK %s
%s%s

" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "HTTP/1.1 200 OK
Content-Type: text/html
Cache-control: private
" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "HTTP/1.1 501 Not Implemented" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "CONNECT %s:%d HTTP/1.1
Proxy-Authorization: Basic %s

" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "HTTP/1.0" (Indicator: "HTTP/1.0"; Source: "sample.bin"), Found string "HTTP/1.1 501 Not Implemented
Server: %s/%s
Date: %s
Connection: close
Content-Type: text/html
Content-Length: %d

%s" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "HTTP/1.1 206 Partial content
Server: %s/%s
Date: %s
%sContent-Type: application/octet-stream
Last-Modified: %s
ETag: "%s"
Content-Length: %I64d
Content-Range: bytes %I64d-%I64d/%I64d

" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "HTTP/1.0 200 OK

" (Indicator: "HTTP/1.0"; Source: "sample.bin"), Found string "GET /time.microsoft.com.%s HTTP/1.0
Host:%s
Connection: keep-alive

" (Indicator: "HTTP/1.0"; Source: "sample.bin"), Found string "HTTP/1.1 400 Bad Request
Server: %s/%s
Date: %s
Connection: close
Content-Type: text/html
Content-Length: %d

%s" (Indicator: "HTTP/1.1"; Source: "sample.bin"), Found string "GET /index.php HTTP/1.1
Host: www.google.com
cookie:" (Indicator: "HTTP/1.1"; Source: "sample.bin")37:Ta34,Found string "\DosDevices\TdxClass0" (Indicator: "\DosDevices\"; Source: "sample.bin"), Found string "
\Device\TdxClass0" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\Nsi" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\Device\TdxClass0" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\windows\system32\DRIVERS\TdxClass.sys" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "\windows\system32\DRIVERS\TdxClass.sys" (Indicator: "system32\drivers"; Source: "sample.bin"), Found string "\system32\drivers\TdxClass.inf" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "\system32\drivers\TdxClass.inf" (Indicator: "system32\drivers"; Source: "sample.bin"), Found string "\system32\drivers\FilterMgr.sys" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "\system32\drivers\FilterMgr.sys" (Indicator: "system32\drivers"; Source: "sample.bin"), Found string "\??\C:\Windows\system32\drivers\TdxClass.sys" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "\??\C:\Windows\system32\drivers\TdxClass.sys" (Indicator: "system32\drivers"; Source: "sample.bin"), Found string "o:\1111111111-7.10-2014-12-20\dllmodule\driver\tdipacket.c" (Indicator: "\driver\"; Source: "sample.bin"), Found string "\system32\drivers\TdxClass.sys" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "\system32\drivers\TdxClass.sys" (Indicator: "system32\drivers"; Source: "sample.bin"), Found string "\Device\Tcp" (Indicator: "\Device\"; Source: "sample.bin"), Found string "\system32\drivers\http.sys" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "\system32\drivers\http.sys" (Indicator: "system32\drivers"; Source: "sample.bin"), Found string "o:\1111111111-7.10-2014-12-20\dllmodule\driver\objchk_win7_amd64\amd64\msfsrvc.pdb" (Indicator: "\driver\"; Source: "sample.bin"), Found string "o:\1111111111-7.10-2014-12-20\dllmodule\driver\objchk_win7_x86\i386\msfsrvc.pdb" (Indicator: "\driver\"; Source: "sample.bin"), Found string "\WINDOWS\System32\DRIVERS\tcpip.sys" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "\WINDOWS\System32\DRIVERS\tcpip.sys" (Indicator: "system32\drivers"; Source: "sample.bin"), Found string "system32\DRIVERS\TdxClass.sys" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "system32\DRIVERS\TdxClass.sys" (Indicator: "system32\drivers"; Source: "sample.bin"), Found string "\WINDOWS\System32\DRIVERS\ntfs.sys" (Indicator: "\drivers\"; Source: "sample.bin"), Found string "\WINDOWS\System32\DRIVERS\ntfs.sys" (Indicator: "system32\drivers"; Source: "sample.bin")38:T70f,Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "sample.bin"), Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), Found reference to API "MakeAbsoluteSD failed with %d.
" (Indicator: "MakeAbsoluteSD"; Source: "sample.bin"), Found reference to API "SetTokenInformation" (Indicator: "SetTokenInformation"; Source: "sample.bin"), Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API "DuplicateTokenEx failed %d" (Indicator: "DuplicateToken"; Source: "sample.bin"), Found reference to API "DuplicateTokenEx failed %d" (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), Found reference to API "GetSecurityDescriptorDacl failed with %d.
" (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API "SetEntriesInAcl failed with %d.
" (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), Found reference to API "SetSecurityDescriptorDacl failed with %d.
" (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid failed with %d.
" (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API "AllocateAndInitializeSid failed with %d.
" (Indicator: "InitializeSid"; Source: "sample.bin"), Found reference to API "SetKernelObjectSecurity failed with %d.
" (Indicator: "SetKernelObjectSecurity"; Source: "sample.bin"), Found reference to API "DuplicateTokenEx() = %d
" (Indicator: "DuplicateToken"; Source: "sample.bin"), Found reference to API "DuplicateTokenEx() = %d
" (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), Found reference to API "GetKernelObjectSecurity failed with %d.
" (Indicator: "GetKernelObjectSecurity"; Source: "sample.bin")39:T27f8,Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "KeReleaseSpinLock"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "ExFreePoolWithTag"; Source: "sample.bin"), Found reference to API (Indicator: "KeQuerySystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "ExAllocatePool"; Source: "sample.bin"), Found reference to API (Indicator: "IoDeleteSymbolicLink"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "StartService"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "ZwQuerySystemInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateServiceA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumServicesStatus"; Source: "sample.bin"), Found reference to API (Indicator: "DbgPrint"; Source: "sample.bin"), Found reference to API (Indicator: "PsCreateSystemThread"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnicodeStringToAnsiString"; Source: "sample.bin"), Found reference to API (Indicator: "RtlTimeToTimeFields"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "KeGetCurrentIrql"; Source: "sample.bin"), Found reference to API (Indicator: "KeRaiseIrqlToDpcLevel"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetAsyncKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "WTSQueryUserToken"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "SetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "WriteProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "KeWaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "ZwOpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "IofCallDriver"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCompareUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "ZwWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "IoGetDeviceObjectPointer"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "SetServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "RegSaveKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "ZwTerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "StartServiceA"; Source: "sample.bin"), Found reference to API (Indicator: "IoGetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ZwQueryValueKey"; Source: "sample.bin"), Found reference to API (Indicator: "ZwCreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "KeInitializeEvent"; Source: "sample.bin"), Found reference to API (Indicator: "ZwSetValueKey"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateService"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingA"; Source: "sample.bin"), Found reference to API (Indicator: "PsTerminateSystemThread"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "IoDetachDevice"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "ZwClose"; Source: "sample.bin"), Found reference to API (Indicator: "RtlFreeAnsiString"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "IofCompleteRequest"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAssert"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceA"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OpenService"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegRestoreKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "MmGetSystemRoutineAddress"; Source: "sample.bin"), Found reference to API (Indicator: "ObfReferenceObject"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "KeBugCheckEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "KeAcquireSpinLockRaiseToDpc"; Source: "sample.bin"), Found reference to API (Indicator: "ObfDereferenceObject"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessAsUserA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "ZwQueryInformationProcess"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "sample.bin"), Found reference to API (Indicator: "SeDebugPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteService"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "ExAllocatePoolWithTag"; Source: "sample.bin"), Found reference to API (Indicator: "ZwOpenKey"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePipe"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API (Indicator: "IoDeleteDevice"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "ControlService"; Source: "sample.bin"), Found reference to API (Indicator: "LookupAccountSidA"; Source: "sample.bin"), Found reference to API (Indicator: "GetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "IoCreateDevice"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerA"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "IoCreateSymbolicLink"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "sample.bin")3a:T502,"SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List" in Source: sample.bin, "\Registry\Machine\SYSTEM\CurrentControlSet\Services\" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: sample.bin, "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\Ekrn" in Source: sample.bin, "2SYSTEM\CurrentControlSet\Control\zxplug" in Source: sample.bin, "HARDWARE\DESCRIPTION\System\CentralProcessor\%d" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\%s" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\%s\Parameters" in Source: sample.bin, "SOFTWARE\McAfee\AVEngine" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\AppMgmt" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\" in Source: sample.bin, "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TdxClass" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Windows" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\TdxClass0" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost" in Source: sample.bin, "\REGISTRY\MACHINE\SYSTEM\CurrentControlSet\services\TdxClass" in Source: sample.bin3b:T41a,Found reference to API "PsSetCreateProcessNotifyRoutine" (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API "0. CreateProcessAsUser() = %d
" (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API "0. CreateProcessAsSessionUser() = %d
" (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API "CreateProcessAsSessionUser failed
" (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API "Error on CreateProcess()" (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API "_CreateProcessAsPid == %d
" (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API "CreateProcessAsUser error:%d
" (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API "CreateProcessAsUser() = %d
" (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API "CreateProcessAsUserA" (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API "CreateProcessA" (Indicator: "CreateProcess"; Source: "sample.bin")3c:T66d,Found string "" (Indicator: ""; Source: "sample.bin"), Found string "[Right]" (Indicator: "[right]"; Source: "sample.bin"), Found string "[TAB]" (Indicator: "[tab]"; Source: "sample.bin"), Found string "[End]" (Indicator: "[end]"; Source: "sample.bin"), Found string "[Home]" (Indicator: "[home]"; Source: "sample.bin"), Found string "[F2]" (Indicator: "[F2]"; Source: "sample.bin"), Found string "[F1]" (Indicator: "[F1]"; Source: "sample.bin"), Found string "[F4]" (Indicator: "[F4]"; Source: "sample.bin"), Found string "[F3]" (Indicator: "[F3]"; Source: "sample.bin"), Found string "[F6]" (Indicator: "[F6]"; Source: "sample.bin"), Found string "[F5]" (Indicator: "[F5]"; Source: "sample.bin"), Found string "[F8]" (Indicator: "[F8]"; Source: "sample.bin"), Found string "[F7]" (Indicator: "[F7]"; Source: "sample.bin"), Found string "[F9]" (Indicator: "[F9]"; Source: "sample.bin"), Found string "[CTRL]" (Indicator: "[ctrl]"; Source: "sample.bin"), Found string "[CTRL]" (Indicator: "[Ctrl]"; Source: "sample.bin"), Found string "[F12]" (Indicator: "[F12]"; Source: "sample.bin"), Found string "[F11]" (Indicator: "[F11]"; Source: "sample.bin"), Found string "[Left]" (Indicator: "[left]"; Source: "sample.bin"), Found string "[F10]" (Indicator: "[F10]"; Source: "sample.bin"), Found string "[PageDown]" (Indicator: "[Pagedown]"; Source: "sample.bin"), Found string "[PageUp]" (Indicator: "[PageUp]"; Source: "sample.bin"), Found string "[Insert]" (Indicator: "[insert]"; Source: "sample.bin"), Found string "[ESC]" (Indicator: "[esc]"; Source: "sample.bin"), Found string "[Down]" (Indicator: "[down]"; Source: "sample.bin")3d:T410,Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API "IoGetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "sample.bin"), Found reference to API "PsLookupProcessByProcessId" (Indicator: "PsLookupProcessByProcessId"; Source: "sample.bin"), Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API "ZwQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "sample.bin"), Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API "EnumProcesses() error.
" (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API "Process32First" (Indicator: "Process32First"; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793926271631,"unified_at":"2026-11-06T00:51:11.631Z","metadata":{"hashes":{"sha256":"5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","sha1":"e036c49c79fccb2378c3db6eefb3073d3aeaa3f1","md5":"7d31919503f3570d46e410919993b034","sha512":"e708296ff39cf7070419c9b96dc8e3a58aee50bd45888b50a35c272e2e58fddf32a4f2ff9e57666fa93d240eaa95460807b3d491d71a60786deae03316e8107a","ssdeep":"24576:2B/IL2+Xk6j8Rd+hK2lGk3aFr5zUKgTVIGiuV2WqOD:S/IL2+U6cd+IKAUKQnZqOD","ssdeep_chunks":["24576:2B/IL2+","24576:B/IL2+X","24576:/IL2+Xk","24576:IL2+Xk6","24576:L2+Xk6j","24576:2+Xk6j8","24576:+Xk6j8R","24576:Xk6j8Rd","24576:k6j8Rd+","24576:6j8Rd+h","24576:j8Rd+hK","24576:8Rd+hK2","24576:Rd+hK2l","24576:d+hK2lG","24576:+hK2lGk","24576:hK2lGk3","24576:K2lGk3a","24576:2lGk3aF","24576:lGk3aFr","24576:Gk3aFr5","24576:k3aFr5z","24576:3aFr5zU","24576:aFr5zUK","24576:Fr5zUKg","24576:r5zUKgT","24576:5zUKgTV","24576:zUKgTVI","24576:UKgTVIG","24576:KgTVIGi","24576:gTVIGiu","24576:TVIGiuV","24576:VIGiuV2","24576:IGiuV2W","24576:GiuV2Wq","24576:iuV2WqO","24576:uV2WqOD","49152:2B/IL2+","49152:B/IL2+X","49152:/IL2+Xk","49152:IL2+Xk6","49152:L2+Xk6j","49152:2+Xk6j8","49152:+Xk6j8R","49152:Xk6j8Rd","49152:k6j8Rd+","49152:6j8Rd+h","49152:j8Rd+hK","49152:8Rd+hK2","49152:Rd+hK2l","49152:d+hK2lG","49152:+hK2lGk","49152:hK2lGk3","49152:K2lGk3a","49152:2lGk3aF","49152:lGk3aFr","49152:Gk3aFr5","49152:k3aFr5z","49152:3aFr5zU","49152:aFr5zUK","49152:Fr5zUKg","49152:r5zUKgT","49152:5zUKgTV","49152:zUKgTVI","49152:UKgTVIG","49152:KgTVIGi","49152:gTVIGiu","49152:TVIGiuV","49152:VIGiuV2","49152:IGiuV2W","49152:GiuV2Wq","49152:iuV2WqO","49152:uV2WqOD","24576:S/IL2+U","24576:/IL2+U6","24576:IL2+U6c","24576:L2+U6cd","24576:2+U6cd+","24576:+U6cd+I","24576:U6cd+IK","24576:6cd+IKA","24576:cd+IKAU","24576:d+IKAUK","24576:+IKAUKQ","24576:IKAUKQn","24576:KAUKQnZ","24576:AUKQnZq","24576:UKQnZqO","24576:KQnZqOD"],"imphash":"360ba640f500b4bb8584bb9ca4cec88b","pehash":"619b6edff6dd5de175eaa2f21ed6e4c35c1438b9"},"file_info":{"file_name":"7961c2cd-4b9f-4c13-a937-78bc295a4752","file_type":["pedll","executable"],"file_type_id":"dll","file_size":950368,"entropy":7.2,"compile_timestamp":"2014-12-24T09:09:53","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286599000,"last_seen":1789990578000,"last_multi_scan":1789990578000},"pe_metadata":{"is_dll":true,"is_packed":false,"section_count":7,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":260955,"raw_size":261120},{"name":".rdata","virtual_address":"0x41000","virtual_size":66638,"raw_size":67072},{"name":".data","virtual_address":"0x52000","virtual_size":376100,"raw_size":230400},{"name":".zh0","virtual_address":"0xae000","virtual_size":268500,"raw_size":268800},{"name":".zh1","virtual_address":"0xf0000","virtual_size":104341,"raw_size":104448},{"name":".reloc","virtual_address":"0x10a000","virtual_size":15284,"raw_size":15360},{"name":".rsrc","virtual_address":"0x10e000","virtual_size":695,"raw_size":1024}],"section_names":[".text",".rdata",".data",".zh0",".zh1",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":3,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":45},"sandbox_signatures":{"informative_count":88,"suspicious_count":6,"malicious_count":2,"total":96},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win32.Zxshell","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Fin7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent.AQGZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Keylogger.2.05698CC7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.ZxShell-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Backdoor_Win32_Sensode_F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Keylogger.2.05698CC7 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Sensode.L trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Heur!.03014020","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Backdoor ( 005d44171 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXHO-FO!7D31919503F3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.GEZK-5700","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Iniecto.WC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Sensode.Win32.80","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Keylogger.2.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"ZxShell","sources":[{"report_type":"qsp","report_id":""}]},{"value":"Webshell","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Able to manipulate address space of the process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"suspicious","value":"References security-related Windows services"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to execute windows services"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Disable or Modify System Firewall","attack_id":"T1562.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/004","identifiers":[{"type":"suspicious","value":"Able to modify firewall settings"},{"type":"informative","value":"Found registry location string related to firewall policy"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"suspicious","value":"References suspicious system modules"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Contains ability to check internet connectivity"},{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to delete device driver (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Web Shell","attack_id":"T1505.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/003","identifiers":[{"type":"suspicious","value":"YARA signature match – ZxShell web shell"},{"type":"suspicious","value":"YARA signature match - Generic web shell"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Generic web shell","description":"YARA signature to detect generic web shell file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1505.003","id":"yara-578","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – ZxShell web shell","description":"YARA signature to detect ZxShell web shell file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1505.003","id":"yara-572","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$36","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"crl.microsoft.com/pki/crl/products/microsoftcodeverifroot.crl0\", Pattern match: \"www.222.com|www.333.com|www.555.com\", Pattern match: \"http://crl.thawte.com/thawtepca.crl0\", Heuristic match: \"|nt.sc\", Pattern match: \"http://www.facebook.com/comment/update.exe\", Pattern match: \"http://%s/%s\", Pattern match: \"http://%s/time.microsoft.com.%s\", Heuristic match: \"microsoft.net\", Pattern match: \"http://x.x.x/x.dll\", Pattern match: \"http://ocsp.thawte.com0\", Pattern match: \"http://cs-g2-crl.thawte.com/thawtecsg2.crl0\", Pattern match: \"www.google.com\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"Revive() ==> connect failed on %s:%d\n\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"Revive() ==> connect the Death Machine %s:%d\n\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"Revive() %s connect %s:%d\n\" (Indicator: \" connect \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"Error On CreatePipe()\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\"), Found reference to API \"CreatePipe failed\n\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\"), Found reference to API \"ConnectNamedPipe failed\n\" (Indicator: \"ConnectNamedPipe\"; Source: \"sample.bin\"), Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"GetUser->NetUserEnum\" (Indicator: \"NetUserEnum\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1087.001","id":"string-112","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"ZXSocksProxy Started Successfully.\n\" (Indicator: \"socksproxy\"; Source: \"sample.bin\"), Found reference to API \"ZXSocksProxy Service Is Running.\n\" (Indicator: \"socksproxy\"; Source: \"sample.bin\"), Found reference to API \"ZXSocksProxy Service Isn't Running.\n\" (Indicator: \"socksproxy\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"socksproxy\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\", Potential IPs \"1.1.1.1\", \"1.1.1.1\" found in string \"Usage:\n     ShareShell IP Port -nc\nExample:\n     ShareShell 1.1.1.1 99 -nc (client nc)\n     ShareShell 1.1.1.1 99 (client controller)\n\", \"9.0.0.8\", Potential IP \"127.0.0.1\" found in string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c net start %s\", Potential IP \"127.0.0.1\" found in string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c del %s\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c net start %s\" (Indicator: \"ping 127\"; Source: \"sample.bin\"), Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c del %s\" (Indicator: \"ping 127\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016.001","id":"string-5070","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c net start %s\" (Indicator: \"ping 127.0.0.1\"; Source: \"sample.bin\"), Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c del %s\" (Indicator: \"ping 127.0.0.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016.001","id":"string-573","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c net start %s\" (Indicator: \"cmd /c ping\"; Source: \"sample.bin\"), Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c net start %s\" (Indicator: \"/c ping\"; Source: \"sample.bin\"), Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c del %s\" (Indicator: \"cmd /c ping\"; Source: \"sample.bin\"), Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c del %s\" (Indicator: \"/c ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeLoadDriverPrivilege\" (Indicator: \"SeLoadDriverPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyA\" in \"sample.bin\", Found registry deletion API: \"SHDeleteKeyA\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeTcbPrivilege\" (Indicator: \"SeTcbPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$37","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"0. CreateProcessAsUser() = %d\n\" (Indicator: \"CreateProcessAsUser\"; Source: \"sample.bin\"), Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.002","id":"string-168","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$38","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"Found string \"netsh firewall set portopening TCP %d \"Core Networking - IPv4 (IPv4)\" ENABLE\" (Source: \"sample.bin\"), Found string \"netsh firewall set portopening TCP %d \"Core Networking - IPv4 (IPv4-In)\" ENABLE\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1562.004","id":"string-676","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ZwTerminateProcess\" (Indicator: \"ZwTerminateProcess\"; Source: \"sample.bin\"), Found reference to API \"ZwTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"ZwWriteFile\" (Indicator: \"ZwWriteFile\"; Source: \"sample.bin\"), Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to manipulate address space of the process (API string)","description":"Found string \"KeUnstackDetachProcess\" (Source: \"sample.bin\"), Found string \"KeStackAttachProcess\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-912","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"References security-related Windows services","description":"\"luafv\" (Indicator: \"luafv\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1574.010","id":"string-43","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c del %s\" (Indicator: \"cmd.exe /c del\") in Source: sample.bin, Observed string: \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c del %s\" (Indicator: \"/c del \") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-408","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"Found reference to API \"IoDeleteDevice\" (Indicator: \"IoDeleteDevice\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1562.001","id":"string-463","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$39","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile Pipe: failed = %d\n\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFile Failed\n\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"ZwCreateFile\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"ZwCreateFile\" (Indicator: \"ZwCreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMapping Failed\n\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"ALYac.aye\" (Indicator: \"alyac\") in Source: sample.bin, \"McAfee @key\" (Indicator: \"mcafee\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: \" (Indicator: \"user-agent: \"; Source: \"sample.bin\"), Found string \"Mozilla/4.0 (compatible; MSIE 8.0; Win32)\" (Indicator: \"mozilla/4.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"doAction_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartService() Faild %d ! \n\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartService() Faild ERROR_IO_PENDING ! \n\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartService() Faild ERROR_SERVICE_ALREADY_RUNNING ! \n\" (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-242","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$3b","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"qc->QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"OpenSCManager() Faild %d ! \n\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), Found reference to API \"EnumServicesStatus\" (Indicator: \"EnumServicesStatus\"; Source: \"sample.bin\"), Found reference to API \"sc->OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), Found reference to API \"OpenSCManager() ok ! \n\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\"), Found reference to API \"IofCallDriver\" (Indicator: \"IofCallDriver\"; Source: \"sample.bin\"), Found reference to API \"IoCreateDevice\" (Indicator: \"IoCreateDevice\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"Usage:\n     Usage: downfile -d c:\\windows\\update.exe http://www.facebook.com/comment/update.exe\n\" (Indicator: \"facebook.com\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess failed with %d.\n\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\"), Found reference to API \"ZwOpenProcess\" (Indicator: \"ZwOpenProcess\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess error:%d\n\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\%s","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-146","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"\\cmd.exe /c\" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\"), Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c net start %s\" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\"), Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c del %s\" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-174","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\update.exe\" (Indicator: \"\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\update.exe\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1547.001","id":"string-265","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"o:\\1111111111-7.10-2014-12-20\\dllmodule\\driver\\objchk_win7_amd64\\amd64\\msfsrvc.pdb\", \"o:\\1111111111-7.10-2014-12-20\\dllmodule\\driver\\objchk_win7_x86\\i386\\msfsrvc.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute windows services","description":"Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c net start %s\" (Indicator: \"net start \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-521","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"C:\\Windows\\System32\\rpcss.dll\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-625","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"sample.bin\"), Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$3c","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"sample.bin\"), Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"sc start %s\" (Indicator: \"sc start\"; Source: \"sample.bin\"), Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c net start %s\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"cmd /c ping 127.0.0.1 -n 7&cmd.exe /c del %s\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"sc delete %s\" (Indicator: \"sc delete\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"WTSQuerySessionInformation failed %d\n\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"sample.bin\"), Found reference to API \"GetUser->NetUserEnum\" (Indicator: \"NetUserEnum\"; Source: \"sample.bin\"), Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\"), Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"2GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\"), Found reference to API \"LookupAccountSidA\" (Indicator: \"LookupAccountSid\"; Source: \"sample.bin\"), Found reference to API \"WTSQueryUserToken failed %d\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\", Found registry query API: \"RegSaveKeyA\" in \"sample.bin\", Found registry query API: \"ZwQueryValueKey\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3d","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"user add   \n\npriv:\nGUEST 0\nUSER  1\nADMIN 2\n\nexample: user add 2 aaa hello\n\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"user [ list | add | del | psw ]\nlist----------lists all accounts.\nadd-----------adds a user account.\ndel-----------deletes a user account.\npsw-----------changes password.\n\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"Anonymous access allowed, send identity (e-mail name) as password.\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"Usage: user psw username password\n\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId() to failed!\n\" (Indicator: \"GetProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-478","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-86","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-915","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"sample.bin\"), Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to firewall policy","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\GloballyOpenPorts\\List\" (Indicator: \"services\\sharedaccess\\parameters\\firewallpolicy\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1562.004","id":"string-415","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"qc->QueryServiceStatus\" (Source: \"sample.bin\"), Found string \"EnumServicesStatus\" (Source: \"sample.bin\"), Found string \"qc->QueryServiceConfig\" (Source: \"sample.bin\"), Found string \"QueryServiceStatus\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-910","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"ZwQuerySystemInformation\" (Indicator: \"ZwQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-907","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ZwQuerySystemInformation\" in \"sample.bin\", Found system information discovery API: \"2GetUserObjectInformationW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"Observed string: \"HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d\" (Indicator: \"hardware\\description\\system\\centralprocessor\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-351","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"2DllGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Successfuly\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"set success!\n\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set %s File Time To %s Successfully.\n\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid failed with %d.\n\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"taskmgr.exe\" (Indicator: \"taskmgr.exe\"; Source: \"sample.bin\"), Found string \"Windows\\regedit.exe\" (Indicator: \"regedit.exe\"; Source: \"sample.bin\"), Found string \"NisSrv.exe\" (Indicator: \"nissrv.exe\"; Source: \"sample.bin\"), Found string \"ccSvcHst.exe\" (Indicator: \"ccsvchst.exe\"; Source: \"sample.bin\"), Found string \"AvastSvc.exe\" (Indicator: \"avastsvc.exe\"; Source: \"sample.bin\"), Found string \"avp.exe\" (Indicator: \"avp.exe\"; Source: \"sample.bin\"), Found string \"egui.exe\" (Indicator: \"egui.exe\"; Source: \"sample.bin\"), Found string \"MsMpEng.exe\" (Indicator: \"msmpeng.exe\"; Source: \"sample.bin\"), Found string \"ekrn.exe\" (Indicator: \"ekrn.exe\"; Source: \"sample.bin\"), Found string \"AntiSniff -a wireshark.exe\" (Indicator: \"wireshark.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-45","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"doAction_CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenService() Faild %d ! \n\" (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"OpenService() ok ! \n\" (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"qc->OpenService\" (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"OpenService\" (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"ReconfigureService->OpenService\" (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\"), Found reference to API \"ZwSetValueKey\" (Indicator: \"ZwSetValueKey\"; Source: \"sample.bin\"), Found reference to API \"RegRestoreKeyA\" (Indicator: \"RegRestoreKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"KeWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig OK.\n\" (Indicator: \"ChangeServiceConfig\"; Source: \"sample.bin\"), Found reference to API \"ChangeServiceConfig Unknown Error.\n\" (Indicator: \"ChangeServiceConfig\"; Source: \"sample.bin\"), Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-192","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken() = %d\n\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), Found reference to API \"OpenProcessToken failed with %d.\n\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), Found reference to API \"OpenProcessToken error:%d\n\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\TdxClass0; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1132","id":"string-338","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-690","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"MmUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.012","id":"string-90","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformation failed %d\n\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"sample.bin\"), Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\"), Found reference to API \"WTSQueryUserToken failed %d\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-546","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceA\" (Indicator: \"CreateService\"; Source: \"sample.bin\"), Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"sample.bin\"), Found reference to API \"failure: CreateService, ERROR_SERVICE_EXISTS\n\" (Indicator: \"CreateService\"; Source: \"sample.bin\"), Found reference to API \"RegisterServiceCtrlHandlerA\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"Found string \"ntoskrnl.exe\" (Indicator: \"ntoskrnl\"; Source: \"sample.bin\"), Found string \"csrss.exe\" (Indicator: \"csrss\"; Source: \"sample.bin\"), Found string \"DESCRIPTION:\n    Create new process as another User or Process context.\n\nUSAGE: runas  ExeFile\n       runas test.exe      (run test.exe with the context of lsass.exe default.)\n       runas 724 test.exe  (run test.exe with the context of specified pid.)\n       runas user password test.exe  (run test.exe as user)\n\" (Indicator: \" lsass\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547.006","id":"string-24","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"svchost.exe,rundll32.exe,winlogon.exe,update.exe,lsass.exe\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-455","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.EXE\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\"), Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\"), Found string \"Explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"Domain:f8b8393166e58b96b611335a37bdddffb099a96dedc1f4f76ae620cfb3264378":{"type":"Domain","value":"api7.mcafee.01o.us","verdict":{"verdict":"suspicious","verdict_source":"domain reputation data","reasons":["reported suspicious domain"]}},"File:5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16":{"type":"File","value":"5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat ZxShell","File reported as trojan by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat ZxShell","reported suspicious domain"]},"filetype":"PE32 executable (DLL) (console) Intel 80386, for MS Windows, 7 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"Threat:ebd8d5f5a17e03deeee1a529b3d8bfc6501b30314c5441fc12c6830beb8ff695":{"type":"Threat","value":"ZxShell","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat ZxShell","confirmed relationship with a Threat"]}},"Url:c2c3a253b252dfa80be77dd72fec488354d7bfcd42521eadfbb81b7467607bd8":{"type":"Url","value":"tcp://api7.mcafee.01o.us","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1551557699110822201","root":"File:5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat ZxShell","File reported as trojan by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat","confirmed relationship with a Threat ZxShell","reported suspicious domain"]}},{"id":"1551557715024860430","root":"File:5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","edges":[{"edge_kind":"contacted_domain","from_key":"File:5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","to_key":"Domain:f8b8393166e58b96b611335a37bdddffb099a96dedc1f4f76ae620cfb3264378"}],"verdict":{"verdict":"suspicious","verdict_source":"domain reputation data","reasons":["reported suspicious domain"]}},{"id":"1551557708105459826","root":"File:5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","to_key":"Threat:ebd8d5f5a17e03deeee1a529b3d8bfc6501b30314c5441fc12c6830beb8ff695"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected","confirmed relationship with a Threat"]}},{"id":"1551557700495296382","root":"File:5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","edges":[{"edge_kind":"contains_c2_config","from_key":"File:5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","to_key":"Url:c2c3a253b252dfa80be77dd72fec488354d7bfcd42521eadfbb81b7467607bd8"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"sandbox_network","root":"File:5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","edges":[{"edge_kind":"contacted_domain","from_key":"File:5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","to_key":"Domain:f8b8393166e58b96b611335a37bdddffb099a96dedc1f4f76ae620cfb3264378"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":1,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"59445116aac2ed9033d45af4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Razy","contacted_countries":["CHN"],"submit_name":"5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16","analysis_start_time":"2017-06-16T22:44:37+00:00","indicators_count":{"informative":9,"suspicious":16,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"api7.mcafee.01o.us","sources":[{"report_type":"qsp","report_id":""}]}],"http_requests":null,"embedded_domains":[{"value":"api7.mcafee.01o.us","sources":[{"report_type":"qsp","report_id":""}]}],"embedded_urls":[{"value":"tcp://api7.mcafee.01o.us","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["59445116aac2ed9033d45af4"]}}}]]}]
2c:[["$","title","0",{"children":"Malicious Keylogger.2.Generic Sample 5d2a4cde9fa7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5d2a4cde9fa7…. Malware family: Keylogger.2.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16"}],["$","meta","4",{"property":"og:title","content":"Malicious Keylogger.2.Generic Sample 5d2a4cde9fa7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5d2a4cde9fa7…. Malware family: Keylogger.2.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Keylogger.2.Generic Sample 5d2a4cde9fa7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5d2a4cde9fa7…. Malware family: Keylogger.2.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3e","11",{}]]
32:null