25:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/3k0jjn7m8jtc5.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/1kn_tf3p-ubex.js"],"ReportDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 24:T542,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Gen:Variant.Jaik — Falcon Sandbox Report — Score 100/100 — Sample 7c185697d3d3…","description":"Malicious verdict for sandbox report 6491d63d2f8c…. Malware family: Gen:Variant.Jaik. Threat score 100/100. 3 malicious and 4 suspicious behavioral indicators across 57 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc/6491d63d2f8c09a25b0e1417","keywords":["Malicious","Gen:Variant.Jaik","sandbox report","malware analysis","MITRE ATT\u0026CK","7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc"],"about":{"@type":"SoftwareApplication","name":"7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc.bin.exe","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows","identifier":"7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Gen:Variant.Jaik","sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":3,"suspicious":4,"totalSignatures":57},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}26:T11c5," Microsoft Corporation\"","description_v2":["\"7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc.bin\" was detected as \"VC8 -> Microsoft Corporation\""],"description_v3":[{"type":"text","value":"\"7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc.bin\" was detected as \"VC8 -> Microsoft Corporation\""}],"origin":"Static Parser","attck_id":"T1027.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"registry-26","type":3,"relevance":2,"name":"Reads the windows installation language","description":"\" Microsoft Corporation","file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","CreateEventW","CreateFileW","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","ExitProcess","FindClose","FindFirstFileExW","FindNextFileW","FlushFileBuffers","FreeEnvironmentStringsW","FreeLibrary","GetACP","GetCommandLineA","GetCommandLineW","GetConsoleMode","GetConsoleOutputCP","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetEnvironmentStringsW","GetFileType","GetLastError","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessHeap","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","InitializeSListHead","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","MultiByteToWideChar","QueryPerformanceCounter","RaiseException","ResetEvent","RtlUnwind","SetEvent","SetFilePointerEx","SetLastError","SetStdHandle","SetUnhandledExceptionFilter","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","WaitForSingleObjectEx","WideCharToMultiByte","WriteConsoleW","WriteFile"]}],"osint_tags":["arkei","back","body","button","close","cluster","code","communicates","copy","cryptocurrency","cyfirma","date","delta","desktop","django","enterprise","exe32","exodus","figure","find","footer","form","fortune","github","grand","impact","inquest","link","main","major","malware","meta","monitoring","mozilla","mystic","open","osint","path","product","python","reload","screen","script","span","star","stealer","steam","template","virustotal","write"],"osint_references":["https://www.cyfirma.com/outofband/mystic-stealer-evolving-stealth-malware/","https://github.com/threatlabz/iocs/blob/main/mystic_stealer/c2s.txt","https://labs.inquest.net/iocdb","https://github.com/threatlabz/iocs/blob/main/mystic_stealer/grand_cluster_domains.txt","https://github.com/threatlabz/iocs/blob/main/mystic_stealer/grand_cluster_nameservers.txt"],"memory_forensics":[{"value":"mscoree.dll","stream_uid":"5112-7-00407721","stream_modal_data_link":"/bff/report/6491d63d2f8c09a25b0e1417/processes/00000000-00006608/streams/0/5112-7-00407721"}],"language":null,"authentihash":"53fd34a00289ccb7538291f07e5f2d08207e4a61245b1ab1d4aabcde7af04698","entrypoint_bytes":null,"pdb_timestamp":null,"pdb_pathway":null,"pdb_guid":null,"file_sections":[{"name":".text","entropy":6.59067560847,"virtual_address":"0x1000","virtual_size":"0x26f4d","raw_size":"0x27000","md5":"4713c2a4da69bac78b29d7b88607f0f4","characteristics":["IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_READ"]},{"name":".rdata","entropy":5.94711976249,"virtual_address":"0x28000","virtual_size":"0xaa36","raw_size":"0xac00","md5":"48099fd18fdca5f01471cf057865f400","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"]},{"name":".data","entropy":2.04109643517,"virtual_address":"0x33000","virtual_size":"0x20d8","raw_size":"0xa00","md5":"a6d12b715b8446fb7e59ba8c5bd39d50","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_WRITE","IMAGE_SCN_MEM_READ"]},{"name":".reloc","entropy":6.61481650999,"virtual_address":"0x36000","virtual_size":"0x1b54","raw_size":"0x1c00","md5":"4001c3f3f9659ebb504374c255b9bdda","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":28,"entrypoint_preview_instructions":["call 0x4029be","jmp 0x402275","push ebp","mov ebp, esp","push 0","call dword ptr [0x428030]","push dword ptr [ebp + 8]","call dword ptr [0x42802c]","push 0xc0000409","call dword ptr [0x428034]","push eax","call dword ptr [0x428038]","pop ebp","ret ","push ebp","mov ebp, esp","sub esp, 0x324","push 0x17","call dword ptr [0x42803c]","test eax, eax","je 0x40243d","push 2","pop ecx","int 0x29","mov dword ptr [0x433b08], eax","mov dword ptr [0x433b04], ecx","mov dword ptr [0x433b00], edx","mov dword ptr [0x433afc], ebx"],"file_resources":[],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[{"name":"IMAGE_DIRECTORY_ENTRY_EXPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_IMPORT","virtual_address":"0x3240c","virtual_size":"0x28","is_in_section":".rdata"},{"name":"IMAGE_DIRECTORY_ENTRY_RESOURCE","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_EXCEPTION","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_SECURITY","virtual_address":"0x34600","virtual_size":"0x4180","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_BASERELOC","virtual_address":"0x36000","virtual_size":"0x1b54","is_in_section":".reloc"},{"name":"IMAGE_DIRECTORY_ENTRY_DEBUG","virtual_address":"0x318f0","virtual_size":"0x1c","is_in_section":".rdata"},{"name":"IMAGE_DIRECTORY_ENTRY_COPYRIGHT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_GLOBALPTR","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_TLS","virtual_address":"0x31940","virtual_size":"0x18","is_in_section":".rdata"},{"name":"IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG","virtual_address":"0x31830","virtual_size":"0x40","is_in_section":".rdata"},{"name":"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_IAT","virtual_address":"0x28000","virtual_size":"0x114","is_in_section":".rdata"},{"name":"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_RESERVED","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null}],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[],"email_headers":null,"classification_tags":[],"tags":[],"submissions":[{"submission_id":"6491ea0e58f522448a0c3ba0","filename":"7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc.bin.exe","url":null,"created_at":"2023-06-20T18:03:58+00:00"},{"submission_id":"6491d63d2f8c09a25b0e1418","filename":"7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc.bin.exe","url":null,"created_at":"2023-06-20T16:39:25+00:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[],"analysis_related_urls":[]},"warnings":["Not all IP/URL string resources were checked online","Not all sources for indicator ID \"api-263\" are available in the report","Not all sources for indicator ID \"registry-177\" are available in the report","Not all sources for indicator ID \"registry-172\" are available in the report"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/6491d63d2f8c09a25b0e1417/download/files/report_json","file_size":215680},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/6491d63d2f8c09a25b0e1417/download/files/memory_strings","file_size":944},"certificate":{"file_name":"certificate.crt","download_url":"/bff/report/6491d63d2f8c09a25b0e1417/download/files/certificate","file_size":16760},"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/6491d63d2f8c09a25b0e1417/download/files/network_pcap","file_size":87533},"memory_dumps":null},"system_resource_monitor":null,"external_reports":{"alien_vault":"https://otx.alienvault.com/indicator/file/7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc/"},"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc"]}}]]}] 1f:null 23:[["$","title","0",{"children":"Malicious Gen:Variant.Jaik — Falcon Sandbox Report — Score 100/100 — Sample 7c185697d3d3… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sandbox report 6491d63d2f8c…. Malware family: Gen:Variant.Jaik. Threat score 100/100. 3 malicious and 4 suspicious behavioral indicators across 57 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc/6491d63d2f8c09a25b0e1417"}],["$","meta","4",{"property":"og:title","content":"Malicious Gen:Variant.Jaik — Falcon Sandbox Report — Score 100/100 — Sample 7c185697d3d3… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sandbox report 6491d63d2f8c…. Malware family: Gen:Variant.Jaik. Threat score 100/100. 3 malicious and 4 suspicious behavioral indicators across 57 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7c185697d3d3a544ca0cef987c27e46b20997c7ef69959c720a8d2e8a03cd5dc/6491d63d2f8c09a25b0e1417"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Gen:Variant.Jaik — Falcon Sandbox Report — Score 100/100 — Sample 7c185697d3d3… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sandbox report 6491d63d2f8c…. Malware family: Gen:Variant.Jaik. Threat score 100/100. 3 malicious and 4 suspicious behavioral indicators across 57 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]