24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample 5fcbcff1557b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5fcbcff1557b…. Malware family: Mint.Zard.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5fcbcff1557b61cacdedf23dfdabe5d303a9edafd911d0c8f7d7cecf0fa2ad2c","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","5fcbcff1557b61cacdedf23dfdabe5d303a9edafd911d0c8f7d7cecf0fa2ad2c"],"about":{"@type":"SoftwareApplication","name":"5fcbcff1557b61cacdedf23dfdabe5d303a9edafd911d0c8f7d7cecf0fa2ad2c.bin","applicationCategory":["peexe","executable"],"identifier":"5fcbcff1557b61cacdedf23dfdabe5d303a9edafd911d0c8f7d7cecf0fa2ad2c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":15,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T53e,Contains base64 string in header "like" in header "GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com" Contains base64 string in header "4664" in header "GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com" Contains base64 string in header "like" in header "GET /okkkkk/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162" Contains base64 string in header "4664" in header "GET /okkkkk/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162" Contains base64 string in header "like" in header "GET /okkkkk/19644.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162" Contains base64 string in header "4664" in header "GET /okkkkk/19644.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162"26:T775," HTTP/1.1 200 OK Date: Tue 31 Mar 2026 10:15:46 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=1wAm8DbMx_xNURHLArQzvpZ1pAhiQPzLC4eKrPh957o-1774952146.4248013-1.0.1.1-HkPD2C5MDhbpU.HrWH31_s8rueB2MJPQtnWm14bbTQX6sCpbkY6ZQr6._cZzmSGohlgO0p2vQXVtAECBmMOzOwzPgQLq4AGybCUr0BPlK_3x3QuKfWWkcOCLEwIqISU2; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Tue 31 Mar 2026 10:45:46 GMT Server: cloudflare CF-RAY: 9e4e98432aca5655-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /okkkkk/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 31 Mar 2026 10:15:47 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Tue 31 Mar 2026 10:10:37 GMT Connection: keep-alive ETag: "69cb9d9d-6" Accept-Ranges: bytes with response body ==>33323436370A....... "GET /okkkkk/19644.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue 31 Mar 2026 10:15:47 GMT Content-Type: text/plain Content-Length: 257803 Last-Modified: Mon 30 Mar 2026 23:58:28 GMT Connection: keep-alive ETag: "69cb0e24-3ef0b" Accept-Ranges: bytes with response body ==>6E407961686F6F2E636F6D3A70617373776F72640A6A6F625F626D61727175657A407961686F6F2E636F6D3A6F63746F62657231360A67616273696D626F7340.......2b:T725,"" (Indicator: "GetDC"; Source: "00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp")34:T9e1,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"@gmail.\"; File: \"5fcbcff1557b61cacdedf23dfdabe5d303a9edafd911d0c8f7d7cecf0fa2ad2c.bin\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mxs.mail.ru\" [Source: PCAP]\n Observed email domain:\"mxs.mail.ru\" [Source: 00000000-00005468.00000000.136591.02C50000.00000004.mdmp\n 00000000-00005468.00000001.138511.02C50000.00000004.mdmp\n 00000000-00005468.00000002.140431.02C50000.00000004.mdmp\n 00000000-00005468.00000003.145934.02C50000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"0.0.0.0\" found in string \"[0.0.0.0]\"\n \"64.124.12.162\"\n \"158.94.211.162\"\n Potential IP \"158.94.211.162\" found in string \"http://158.94.211.162/\"\n \"58.94.211.162\"\n Potential IP \"158.94.211.162\" found in string \"ttp://158.94.211.162/okkkkk/19644.txt\"\n Potential IP \"158.94.211.162\" found in string \"ttp://158.94.211.162/okkkkk/n.txt\"\n Potential IP \"158.94.211.162\" found in string \"//158.94.211.162/okkkkk/n.txt\"\n Potential IP \"1.0.1.1\" found in string \"1wAm8DbMx_xNURHLArQzvpZ1pAhiQPzLC4eKrPh957o-1774952146.4248013-1.0.1.1-HkPD2C5MDhbpU.HrWH31_s8rueB2MJPQtnWm14bbTQX6sCpbkY6ZQr6._cZzmSGohlgO0p2vQXVtAECBmMOzOwzPgQLq4AGybCUr0BPlK_3x3QuKfWWkcOCLEwIqISU2\"\n Potential IP \"158.94.211.162\" found in string \"http://158.94.211.162/okkkkk/19644.txt\"\n Potential IP \"158.94.211.162\" found in string \"http://158.94.211.162/okkkkk/n.txt\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$31","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$32","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005468.00000000.136591.02C50000.00000004.mdmp, 00000000-00005468.00000001.138511.02C50000.00000004.mdmp, 00000000-00005468.00000002.140431.02C50000.00000004.mdmp, 00000000-00005468.00000003.145934.02C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: icanhazip.com\n\n GET /okkkkk/n.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: 158.94.211.162\n\n GET /okkkkk/19644.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: 158.94.211.162\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"mta5.am0.yahoodns.net\" has high entropy\n Contacted domain: \"mta6.am0.yahoodns.net\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69cb9eb46300b4d3cb06d571"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"