26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 57:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4cc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 8a9b90111fec… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8a9b90111fec…. Malware family: Trojan.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 10 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379"],"about":{"@type":"SoftwareApplication","name":"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":10,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T99b,Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt16" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin"28:T1736,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "HMACSHA512" (Indicator: "HMAC"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "HMACSHA512" (Indicator: "SHA512"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "Rijndael" (Indicator: "Rijndael"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp, 00000000-00003340.00000000.108781.048B0000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp, 00000000-00003340.00000000.108781.048B0000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMAC"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp, 00000000-00003340.00000000.108781.048B0000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp, 00000000-00003340.00000000.108781.048B0000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "SHA512"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp, 00000000-00003340.00000000.108781.048B0000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp, 00000000-00003340.00000000.108781.048B0000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp, 00000000-00003340.00000000.108781.048B0000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp, 00000000-00003340.00000000.108781.048B0000.00000004.mdmp")29:T634,"" (Indicator: "enumchildwindows"; Source: "00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00003340.00000000.108781.048B0000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00003340.00000000.108781.048B0000.00000004.mdmp")2f:Teec,"" (Indicator: "GetDC"; Source: "00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp")48:T9e4,"" (Indicator: "base64"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "Pass encoding="base64">" (Indicator: "base64"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "Rijndael" (Indicator: "rijndael"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp, 00000000-00003340.00000000.108781.048B0000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp")4a:T4ae,Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp")4b:Tcba,Found string "k__BackingField" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "get_password" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "set_password" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "passwordVaultPtr" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "syncpassword" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "password-check" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "password_value" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "\\passwordstorerc" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "password=" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "password" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string ".*\"password\":\"(.*?)\"" (Indicator: "password"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "passwordstorerc" (Indicator: "password"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "*"password":"(.*?)"" (Indicator: "password"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "server_user_password>" (Indicator: "password"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "/server_user_password>" (Indicator: "password"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "yncpassword" (Indicator: "password"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "password>" (Indicator: "password"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "/password>" (Indicator: "password"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "k__BackingField" (Indicator: "password"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "get_password" (Indicator: "password"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "set_password" (Indicator: "password"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp")4c:T9de,"Software\Microsoft\Office\11.0\Outlook\Profiles" in Source: 8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin "Software\Microsoft\Office\12.0\Outlook\Profiles" in Source: 8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin "Software\Microsoft\Office\14.0\Outlook\Profiles" in Source: 8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin "Software\Microsoft\Office\15.0\Outlook\Profiles" in Source: 8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin "Software\Microsoft\Office\16.0\Outlook\Profiles" in Source: 8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin "\VirtualStore\Program Files\Foxmail\mail" in Source: 8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin "\VirtualStore\Program Files (x86)\Foxmail\mail" in Source: 8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin "\Opera Mail\Opera Mail\wand.dat" in Source: 8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin "\Thunderbird\" in Source: 8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin "\Postbox\" in Source: 8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin "\\Claws-mail" in Source: 60000a4-ubNAyk~Grab "Software\\Microsoft\\Office\\11.0\\Outlook\\Profiles" in Source: 6000101-5sVaPV6~Grab "Software\\Microsoft\\Office\\12.0\\Outlook\\Profiles" in Source: 6000101-5sVaPV6~Grab "Software\\Microsoft\\Office\\14.0\\Outlook\\Profiles" in Source: 6000101-5sVaPV6~Grab "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles" in Source: 6000101-5sVaPV6~Grab "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles" in Source: 6000101-5sVaPV6~Grab "\\Opera Mail\\Opera Mail\\wand.dat" in Source: 600010f-9XRRLK1P~Grab "\\Pocomail\\accounts.ini" in Source: 6000115-WCfi3XUeV~Grab "\\Thunderbird\\" in Source: 6000182-msljUSkKUDi~BXX "\\Postbox\\" in Source: 6000182-msljUSkKUDi~BXX "oftware\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00003340.00000000.108781.00082000.00000002.mdmp "oftware\Microsoft\Office\12.0\Outlook\Profiles" in Source: 00000000-00003340.00000000.108781.00082000.00000002.mdmp "oftware\Microsoft\Office\14.0\Outlook\Profiles" in Source: 00000000-00003340.00000000.108781.00082000.00000002.mdmp "oftware\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00003340.00000000.108781.00082000.00000002.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00003340.00000000.108781.00082000.00000002.mdmp4d:T5ea,Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "Select * from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "elect * from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00003340.00000000.108781.00082000.00000002.mdmp") Found string "Select * from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00003340.00000001.110700.02912000.00000004.mdmp, 00000000-00003340.00000002.112620.02912000.00000004.mdmp, 00000000-00003340.00000003.118130.02912000.00000004.mdmp")4e:T85f,"\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "\FTPGetter\servers.xml" (Indicator: "\ftpgetter") "quick.dat" (Indicator: "quick.dat") "FTP Navigator" (Indicator: "ftp navigator") "\\FTP Navigator\\Ftplist.txt" (Indicator: "ftp navigator") "\\FTP Navigator\\Ftplist.txt" (Indicator: "ftplist.txt") "\\VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftp commander") "\\VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftplist.txt") "\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftp commander") "\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftplist.txt") "\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftp commander") "\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftplist.txt") "\\cftp\\Ftplist.txt" (Indicator: "ftplist.txt") "\\VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftp commander") "\\VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftplist.txt") "\\FTPGetter\\servers.xml" (Indicator: "\ftpgetter") "FTP Navigator\Ftplist.txt" (Indicator: "ftp navigator") "FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "cftp\Ftplist.txt" (Indicator: "ftplist.txt") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt")4f:T6f6,Found string "\Device\LanmanRedirector\" (Indicator: "\Device\"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string "\\Device\\LanmanRedirector\\" (Indicator: "\Device\"; File: "8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00003340.00000001.110700.02912000.00000004.mdmp, 00000000-00003340.00000001.110700.02948000.00000004.mdmp, 00000000-00003340.00000002.112620.02912000.00000004.mdmp, 00000000-00003340.00000002.112620.02948000.00000004.mdmp, 00000000-00003340.00000003.118130.02912000.00000004.mdmp, 00000000-00003340.00000003.118130.02948000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00003340.00000001.110700.02912000.00000004.mdmp, 00000000-00003340.00000001.110700.02948000.00000004.mdmp, 00000000-00003340.00000002.112620.02912000.00000004.mdmp, 00000000-00003340.00000002.112620.02948000.00000004.mdmp, 00000000-00003340.00000003.118130.02912000.00000004.mdmp, 00000000-00003340.00000003.118130.02948000.00000004.mdmp") Found string "Win32API|System Information Functions|GetSystemDirectory|\drivers\etc\lmhosts" (Indicator: "\drivers\"; Source: "00000000-00003340.00000001.110700.02948000.00000004.mdmp, 00000000-00003340.00000002.112620.02948000.00000004.mdmp, 00000000-00003340.00000003.118130.02948000.00000004.mdmp")50:T802,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\root\\cimv2; Source: \"00000000-00003340.00000000.108781.02870000.00000004.mdmp, 00000000-00003340.00000001.110700.02870000.00000004.mdmp, 00000000-00003340.00000002.112620.02870000.00000004.mdmp, 00000000-00003340.00000003.118130.02870000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00003340.00000000.108781.048B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\" HTTP/1.1 200 OK\nDate: Tue\n 24 Mar 2026 11:58:31 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 6\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>66616C73650A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\", Potential IP \"4.0.0.0\" found in string \"n=4.0.0.0\n C\", \"2.5.29.10\", \"2.5.29.19\", \"2.5.29.14\", \"2.5.29.15\", \"2.5.29.37\", \"192.168.0.1\", \"255.255.255.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /line/?fields=hosting HTTP/1.1\nHost: ip-api.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://account.dyn.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"sample.bin\"\n YARA signature for encryption algorithm process \"00000000-00003340\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Windows Vault","description":"Found string \"VaultGetItem_WIN8\" (Indicator: \"VaultGetItem_WIN8\"; File: \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\")\n Found string \"VaultGetItem_WIN8\" (Indicator: \"VaultGetItem\"; File: \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\")\n Found string \"VaultGetItem\" (Indicator: \"VaultGetItem\"; File: \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\")\n Found string \"VaultEnumerateItems\" (Indicator: \"VaultEnumerateItems\"; File: \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\")\n Found string \"VaultEnumerateVaults\" (Indicator: \"VaultEnumerateVaults\"; File: \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\")\n Found string \"VaultOpenVault\" (Indicator: \"VaultOpenVault\"; File: \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-627","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"8653241270,7384,3024,,RtlGetVersion,NTDLL.dll,\"00:28:18.468\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003340.00000000.108781.02870000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003340.00000000.108781.048B0000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00003340.00000000.108781.048B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueEx\" in file \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\"\n Found registry query API: \"RegOpenKeyEx\" in file \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\"\n Found registry query API: \"RegQueryValueEx\" in \"00000000-00003340.00000000.108781.00082000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyEx\" in \"00000000-00003340.00000000.108781.00082000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"8a9b90111fec106d68dd4c23b644b9bd7eb61a71fc67cd1e2cdfb9133224c379.bin\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00003340.00000000.108781.00082000.00000002.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00003340.00000000.108781.00082000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00003340.00000000.108781.00082000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$48","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69c27c43333e7129a3033bb3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"