26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 54:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware.Generic Sample 82407811fbdc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 82407811fbdc…. Malware family: Malware.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f","keywords":["Malicious","Malware.Generic","malware analysis","sandbox report","threat intelligence","82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f"],"about":{"@type":"SoftwareApplication","name":"RedEngine.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T465,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "VirtualAllocEx failed: 0x{0:X8}" (Indicator: "VirtualAlloc"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "VirtualAllocEx failed: 0x{0:X8}" (Indicator: "VirtualAllocEx"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "WriteProcessMemory failed: 0x{0:X8}" (Indicator: "WriteProcessMemory"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "WriteProcessMemory failed: 0x{0:X8} - {1}/{2} bytes" (Indicator: "WriteProcessMemory"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin")28:Tc6a,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReAllocHGlobal" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetFunctionPointerForDelegate" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteIntPtr" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt64" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin"29:T4b2,82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin has big resource with name: "costura.messagepack.dll.compressed" size: "146677" and abnormal entropy:"7.995673663150094" 82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin has big resource with name: "costura.system.collections.immutable.dll.compressed" size: "105501" and abnormal entropy:"7.993459079455883" 82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin has big resource with name: "costura.system.memory.dll.compressed" size: "59807" and abnormal entropy:"7.995401382862062" 82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin has big resource with name: "costura.system.numerics.vectors.dll.compressed" size: "32868" and abnormal entropy:"7.984935838008249" 82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin has big resource with name: "costura.system.threading.tasks.extensions.dll.compressed" size: "13443" and abnormal entropy:"7.981863170742442" 82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin has big resource with name: "costura.pulsar.common.dll.compressed" size: "69624" and abnormal entropy:"7.9911389177281995"2a:T448,Found reference to API "SysNtQueryInformationProcess2" (Indicator: "NtQueryInformationProcess"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "SysNtQueryInformationProcess3" (Indicator: "NtQueryInformationProcess"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "IsDebuggerPresentCheck" (Indicator: "IsDebuggerPresent"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "NtQueryInformationProcessCheck_ProcessDebugFlags" (Indicator: "NtQueryInformationProcess"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "NtQueryInformationProcessCheck_ProcessDebugPort" (Indicator: "NtQueryInformationProcess"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "NtQueryInformationProcessCheck_ProcessDebugObjectHandle" (Indicator: "NtQueryInformationProcess"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin")2b:T803,Found api reference "BCrypt.BCryptOpenAlgorithmProvider() failed with status code:{0}" (Indicator: "BCryptOpenAlgorithmProvider"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found api reference "BCrypt.BCryptGetProperty() (get size) failed with status code:{0}" (Indicator: "BCryptGetProperty"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found api reference "BCrypt.BCryptGetProperty() failed with status code:{0}" (Indicator: "BCryptGetProperty"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found api reference "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found api reference "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found api reference "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found api reference "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found api reference "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found api reference "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "CryptImportKey"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found api reference "CryptEncrypt failed with status code 0x{0:X8}." (Indicator: "CryptEncrypt"; File: "AMSI") Found api reference "CryptDecrypt failed with status code 0x{0:X8}." (Indicator: "CryptDecrypt"; File: "AMSI") Found api reference "CryptImportKey failed with status code 0x{0:X8}." (Indicator: "CryptImportKey"; File: "AMSI")2c:T697,Found reference to API "BCrypt.BCryptGetProperty() (get size) failed with status code:{0}" (Indicator: "BCryptGetProperty"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "BCrypt.BCryptGetProperty() failed with status code:{0}" (Indicator: "BCryptGetProperty"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "BCrypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "BCrypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "BCrypt.BCryptImportKey() failed with status code:{0}" (Indicator: "CryptImportKey"; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found reference to API "CryptEncrypt failed with status code 0x{0:X8}." (Indicator: "CryptEncrypt"; File: "AMSI") Found reference to API "CryptDecrypt failed with status code 0x{0:X8}." (Indicator: "CryptDecrypt"; File: "AMSI") Found reference to API "CryptImportKey failed with status code 0x{0:X8}." (Indicator: "CryptImportKey"; File: "AMSI")2d:T433,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains asymmetric cryptographic functions (API string) Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Contains ability to perform crypto operations Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm2e:T1aa2,Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 235370; code bytes = 30d0 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 328157; code bytes = 30d0 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 20250; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 106035; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 178539; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 178675; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 179395; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 179435; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 180611; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 181667; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 186475; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 187435; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 189323; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 192419; code bytes = 8030 Found XOR loop in file "SharpDX.Direct2D1.dll" at offset 325246; code bytes = 8030 Found XOR loop in file "SharpDX.Direct3D11.dll" at offset 75919; code bytes = 8030 Found XOR loop in file "SharpDX.Direct3D11.dll" at offset 76959; code bytes = 8030 Found XOR loop in file "SharpDX.Direct3D11.dll" at offset 80127; code bytes = 8030 Found XOR loop in file "SharpDX.Direct3D11.dll" at offset 83319; code bytes = 8030 Found XOR loop in file "SharpDX.Direct3D11.dll" at offset 83655; code bytes = 8030 Found XOR loop in file "SharpDX.Direct3D11.dll" at offset 86647; code bytes = 8030 Found XOR loop in file "SharpDX.Direct3D11.dll" at offset 86863; code bytes = 8030 Found XOR loop in file "SharpDX.Direct3D11.dll" at offset 87751; code bytes = 8030 Found XOR loop in file "SharpDX.Direct3D11.dll" at offset 87983; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 120735; code bytes = 33c1 Found XOR loop in file "SharpDX.dll" at offset 7861; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 41419; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 41675; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 41867; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 41979; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 43059; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 44075; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 45531; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 49195; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 50395; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 52683; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 53555; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 53979; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 54971; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 69659; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 72243; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 72275; code bytes = 8030 Found XOR loop in file "SharpDX.dll" at offset 119600; code bytes = 8030 Found XOR loop in file "SharpDX.Mathematics.dll" at offset 23278; code bytes = 8030 Found XOR loop in file "NAudio.Core.dll" at offset 61771; code bytes = 30040e Found XOR loop in file "NAudio.Core.dll" at offset 78411; code bytes = 8030 Found XOR loop in file "NAudio.Core.dll" at offset 108773; code bytes = 8030 Found XOR loop in file "NAudio.Wasapi.dll" at offset 88473; code bytes = 33c1 Found XOR loop in file "NAudio.Wasapi.dll" at offset 43487; code bytes = 8030 Found XOR loop in file "NAudio.Wasapi.dll" at offset 45701; code bytes = 8030 Found XOR loop in file "NAudio.Wasapi.dll" at offset 45989; code bytes = 8030 Found XOR loop in file "NAudio.Wasapi.dll" at offset 46577; code bytes = 8030 Found XOR loop in file "NAudio.Wasapi.dll" at offset 51095; code bytes = 8030 Found XOR loop in file "SharpDX.DXGI.dll" at offset 33061; code bytes = 8030 Found XOR loop in file "SharpDX.DXGI.dll" at offset 34585; code bytes = 8030 Found XOR loop in file "SharpDX.DXGI.dll" at offset 35085; code bytes = 8030 Found XOR loop in file "SharpDX.DXGI.dll" at offset 35961; code bytes = 8030 Found XOR loop in file "SharpDX.DXGI.dll" at offset 36855; code bytes = 8030 Found XOR loop in file "SharpDX.DXGI.dll" at offset 37761; code bytes = 8030 Found XOR loop in file "AForge.Video.DirectShow.dll" at offset 27179; code bytes = 8030 Found XOR loop in file "SharpDX.D3DCompiler.dll" at offset 20791; code bytes = 8030 Found XOR loop in file "NAudio.WinMM.dll" at offset 17885; code bytes = 8030 Found XOR loop in file "NAudio.WinMM.dll" at offset 18101; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 196904; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 282356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 301889; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 370664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 447552; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 481534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 248313; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 320809; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 327591; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 531924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 538112; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 560746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 589348; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 614730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 675899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 32309; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 151813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 182309; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 486133; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 486961; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 572565; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 654495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 659671; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 660239; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 660383; code bytes = 80302f:T612,Found string "SELECT * FROM Win32_BIOS" (Indicator: "select * from "; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: "select * from "; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: "select * from "; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "select * from "; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found string "SELECT * FROM FirewallProduct" (Indicator: "select * from "; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found string "Select * from Win32_ComputerSystem" (Indicator: "select * from "; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found string "SELECT * FROM Win32_DiskDrive" (Indicator: "select * from "; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin") Found string "SELECT * FROM Win32_PortConnector" (Indicator: "select * from "; File: "82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin")30:Ta39,">) at e5eab03abed91d6790129362597b2953-6000417-pSYtwJphPOZDYh6YZ8fhGwAX6oc~sV9ODUDL7Vg71nEnwp5Dpi0YfKx3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLengthA\" (Indicator: \"GetWindowText\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")\n Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")\n Found reference to API \"EnumWindowsProc\" (Indicator: \"EnumWindows\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")\n Found reference to API \"FindWindowAntiDebug\" (Indicator: \"FindWindow\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\" HTTP/1.1 200 OK\nDate: Sun\n 05 Apr 2026 12:07:37 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 945\nConnection: keep-alive\ncf-cache-status: HIT\nAccess-Control-Allow-Origin: *\nAccept-Ranges: bytes\nServer: cloudflare\nCF-RAY: 9e786efd09b5349f-SJC\nalt-svc: h3=\":443\"; ma=86400 with response body ==>7B0A20202020226970223A202236342E3132342E31322E313632222C0A202020202273756363657373223A20747275652C0A202020202274797065223A202249.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"nul 2>&1 & exit\" (Indicator: \"\"del \") in Source: 82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")\n Found reference to API \"Failed to enable SeDebugPrivilege.\" (Indicator: \"SeDebugPrivilege\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")\n Found reference to API \"Failed to disable SeDebugPrivilege.\" (Indicator: \"SeDebugPrivilege\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList failed: 0x{0:X8}\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")\n Found reference to API \"UpdateProcThreadAttribute (PPID) failed: 0x{0:X8}\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")\n Found reference to API \"UpdateProcThreadAttribute (Mitigation) failed: 0x{0:X8}\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"82407811fbdc8699f81e246173d8bdc48faa9a0c2fd00662b2b3e2daa9d8e52f.bin\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"ystem.Runtime.CompilerServices.IgnoresAccessChecksToAttribute\" (Indicator: \"AccessCheck\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 60003fd-DI5FlSbjpjPDo4At5HKa1hL0m0S~So9alYYdmcqoOEvFFEqwW\n Observed string: \"Shutdown action failed:\" (Indicator: \"shutdown \") in Source: 60003fd-DI5FlSbjpjPDo4At5HKa1hL0m0S~So9alYYdmcqoOEvFFEqwW","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69d2505f5a737d2768055ec4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"