24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ee,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Capa_get_geographical_location Sample 86ad203b4dfc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 86ad203b4dfc…. Malware family: Capa_get_geographical_location. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009","keywords":["Malicious","Capa_get_geographical_location","malware analysis","sandbox report","threat intelligence","86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009"],"about":{"@type":"SoftwareApplication","name":"hitclub.nagoya_6d604600_q_7zip-setup.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Capa_get_geographical_location","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7c3,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin"26:T448,Found reference to "Aes256" (Indicator: "Aes"; File: "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin") Found reference to "AesEngine" (Indicator: "Aes"; File: "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin") Found reference to "DecryptAesGcm" (Indicator: "Aes"; File: "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin") Found reference to "DecryptAesGcm" (Indicator: "AesGcm"; File: "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; File: "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004980-00000BC0-848080821")27:T46c," HTTP/1.1 301 Moved Permanently Date: Wed 10 Jun 2026 10:49:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server-Timing: cfEdge;dur=5 cfOrigin;dur=0 Location: https://hitclub.paris/ Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JSU09zX%2BcExdiSSZjGNfdxL7gK0fp%2FvrPUv%2BpiSRQyIQnforJgswOr40wtz4P10j6C8D2eJENmzPfvjUsj9U9zLefipREwdftKyzqmQurRzXvWNLeqbLl2Ckt0Y29wcaxpY2jRY%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a097cfd34e7c15d0-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET / HTTP/1.1 Host: hitclub.paris Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Date: Wed 10 Jun 2026 10:49:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server-Timing: cfEdge;dur=2 cfOrigin;dur=0 Location: https://citrum.io/ Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=P7f7OqcwzSf1wbKVX6a9NUru3S0lT6ql69ePEPeKyS9FUbE%2BKJlLj6KHxcG6J2eTFPNql51EAFxu0iwIbi%2FdmqyQ318GBvXvHYGNaDv2GUqQLfxNj4%2BxuYFwelP5q0is"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a097cfd44c461fa8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C626F6479....... "GET / HTTP/1.1 Host: citrum.io Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Wed 10 Jun 2026 10:49:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Vary: Accept-Encoding Link: ; rel="https://api.w.org/" Link: ; rel="alternate"; title="JSON"; type="application/json" Link: ; rel=shortlink Strict-Transport-Security: max-age=31536000 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=TcB21Mmx6rVrI8R5Qw8zmiLFA7rX9K3nrSy0Ap3Y7uh%2BNGq4mvuY7fibDAT%2BzZDoz3IvyfoEIjBJetxBCh9updIxEQbz5GSTYi%2BmzMfo0ZW3Q64yC30RsIOQWU4%3D"}]} Cf-Cache-Status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=7 cfOrigin;dur=1307 CF-RAY: a097cfd50eafe418-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C206C616E673D22766922207072656669783D226F673A2068747470733A2F2F6F67702E6D652F6E73232220.......34:T6d8,"k__BackingField\" (Indicator: \"countrycode\") in Source: 86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\n \"get_CountryCode\" (Indicator: \"countrycode\") in Source: 86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\n \"set_CountryCode\" (Indicator: \"countrycode\") in Source: 86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-575","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"Quasar.Client.Messages.SystemInformationHandler::Execute(Quasar.Common.Networking.ISender,Quasar.Common.Messages.GetSystemInfo) at 346109534281c5eb89936cbb03f43f9d-6000161-SystemInformationHandler~Execute\n Quasar.Common.Messages.GetSystemInfoResponse::set_SystemInfos(System.Collections.Generic.List`1>) at 346109534281c5eb89936cbb03f43f9d-6000162-SystemInformationHandler~Execute","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindowTitle\" (Indicator: \"GetForegroundWindow\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\" nuldel /a /q /f \"\" (Indicator: \"ping -\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\"), Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\ndel /a /q /f \\\"\" (Indicator: \"ping -\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")\n Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\nstart \\\"\\\" \\\"\" (Indicator: \"ping -\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"15000[Esc]

\" (Indicator: \"[esc]\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"hostname\" (Indicator: \"hostname\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")\n Found string \"HostName\" (Indicator: \"hostname\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")\n Found string \"/K CHCP {0}\" (Indicator: \"chcp\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$40","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: 86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"86ad203b4dfcd43bdc93bea91e9fc01b613e4fa755fcf3b298e8d1e74e168009.bin\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a29413913adcfc9060cf2fc"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"