34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3c:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4af,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample 8d97412b2d1d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8d97412b2d1d…. Malware family: Yogi.Generic. Threat score 100/100. 4/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8d97412b2d1d6ec5b7f0ae3e5320106f2b9cc99dcc52399107cd2b4ae398c5dd","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","8d97412b2d1d6ec5b7f0ae3e5320106f2b9cc99dcc52399107cd2b4ae398c5dd"],"about":{"@type":"SoftwareApplication","name":"8d97412b2d1d6ec5b7f0ae3e5320106f2b9cc99dcc52399107cd2b4ae398c5dd","applicationCategory":["pedll","executable"],"identifier":"8d97412b2d1d6ec5b7f0ae3e5320106f2b9cc99dcc52399107cd2b4ae398c5dd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":4,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T142c,Pattern match: "https://{0}{1}{2", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/fun/soundboard/soundlibrary.txt", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/images/mods/visuals/warning.png", Pattern match: "github.com/poopoovr", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/fun/tagsounds/", Pattern match: "https://github.com/", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/movement/portalgun/portal_invalid.ogg", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/videos/vstump-video.mp4", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/movement/portalgun/portal_close.ogg", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/movement/portalgun/portal_exit1.ogg", Pattern match: "https://api-prod-iidk-de.corgi.st/v1/api/iiservers", Heuristic match: "api-prod-iidk-de.corgi.st", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/menu/prev.ogg", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/fun/shutdown.ogg", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/guns/grip-press.ogg", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/menu/console.ogg", Pattern match: "https://.mat", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/fun/soundboard/sounds/", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/movement/portalgun/portalgun_fizzle.ogg", Pattern match: "https://github.com/poopoovr/fn/releases/download/1/fn", Pattern match: "github.com/corgisolutions", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/menu/buttons/", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/communityconfigs/index.json", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/menu/notifications/win7-exc.ogg", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/overpowered/kamehameha/end.ogg", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/images/themes/mlm.png", Pattern match: "https://github.com/iimenu/manifest/raw/refs/heads/main/menuversion.json", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/images/customwatermark.png", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/videos/tutorial/tutorial-", Pattern match: "https://github.com/iimenu/manifest/raw/refs/heads/main/api.json", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/images/mods/visuals/oculus.png", Pattern match: "github.com/theking13245", Pattern match: "https://{0}{1}{2}?size={3}&animated=true", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/guns/grip-release.ogg", Pattern match: "https://www.myinstants.com", Pattern match: "https://github.com/iimenu/project/gpl/warranty", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/images/mods/important/pause.png", Pattern match: "github.com/noob123ii", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/images/themes/pride.png", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/images/mods/visuals/", Pattern match: "api-prod-iidk-de.corgi.st/v2/ws", Pattern match: "https://github.com/iimenu/manifest/raw/refs/heads/main/menustatus.json", Heuristic match: "cdn.discordapp.com", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/menu/buttons/poopsound.ogg", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/images/mods/visuals/speak.png", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/guns/trigger-hold.ogg", Pattern match: "https://myinstants-api-gamma.vercel.app/search?q=", Pattern match: "https://api-prod-iidk-de.corgi.st/v2/cfg", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/images/mods/fun/jumpscare.png", Pattern match: "https://lazypy.ro/tts/audio/", Pattern match: "https://myinstants-api-gamma.vercel.app/trending?q=en", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/overpowered/timestop/start.ogg", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/images/mods/movement/pearl.png", Pattern match: "https://raw.githubusercontent.com/iimenu/project/main/resources/server/audio/mods/fun/shotgun.ogg"37:Tf4f,Found reference to API "Automatically attempts to connect to room "SREN17" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "VEN1" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "ws connect failed: " (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "DAISY09" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "[iiSERVERS] No iiServers code is set. Check the API or connect first." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "MODS" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "RUN" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to the iiMenu room "IIMENU" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "J3VU" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "HELP" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "iiServers shutdown restore failed: " (Indicator: " shutdown "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "JUANGTAG" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "BOT" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "ELLIOT" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Enables binding mode, letting you bind a mod to a button." (Indicator: " bind "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "HACKER" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "DAISY" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "GULLIBLE" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "iiServers connect timeout state={0} server={1} cloudRegion={2}" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "[iiSERVERS] Could not connect to iiServers (" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "FURRY" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "IDIOT" every couple of seconds until connected" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Attempting to connect to '{0}'" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "CRIMSON" every couple of seconds until connected" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Automatically attempts to connect to room "JMANCURLY" every couple of seconds until connected." (Indicator: " connect "; Source: "sample.bin")38:T1140,Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Mods/Fun/Soundboard/SoundLibrary.txt" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Images/Mods/Visuals/warning.png" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Mods/Fun/TagSounds/" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Mods/Movement/PortalGun/portal_invalid.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Videos/vstump-video.mp4" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Mods/Movement/PortalGun/portal_close.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Mods/Movement/PortalGun/portal_exit1.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Menu/prev.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Mods/Fun/shutdown.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Guns/grip-press.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Menu/console.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Mods/Fun/Soundboard/Sounds/" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Mods/Movement/PortalGun/portalgun_fizzle.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Menu/Buttons/" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/CommunityConfigs/index.json" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Menu/Notifications/win7-exc.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Mods/Overpowered/Kamehameha/end.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Images/Themes/mlm.png" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Images/CustomWatermark.png" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Videos/Tutorial/tutorial-" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Images/Mods/Visuals/oculus.png" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Audio/Guns/grip-release.ogg" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Images/Mods/Important/pause.png" (Indicator: "githubusercontent.com"; Source: "sample.bin"), Found string "https://raw.githubusercontent.com/iimenu/project/main/Resources/Server/Images/Themes/pride.png" (Indicator: "githubusercontent.com"; Source: "sample.bin")39:T838,Observed string: " echo. echo Your menu is updating, please wait... echo. where curl >nul 2>nul if errorlevel 1 ( echo curl was not found on this PC, cannot update. exit /b 1 ) echo Downloading ii Reborn... curl -L -f -sS -o "%TEMP%\ii.Reborn.new.dll" "%URL%" if errorlevel 1 ( echo Download failed, your current menu was not changed. del /f /q "%TEMP%\ii.Reborn.new.dll" >nul 2>nul exit /b 1 ) set "GOT=" for /f "delims=" %%h in ('certutil -hashfile "%TEMP%\ii.Reborn.new.dll" SHA256 ^| findstr /r "^[0-9a-fA-F]*$"') do if not defined GOT set "GOT=%%h" if not defined GOT ( echo Could not verify the download, your current menu was not changed. del /f /q "%TEMP%\ii.Reborn.new.dll" >nul 2>nul exit /b 1 ) if /i not "%GOT%"=="%EXPECTED%" ( echo Download does not match the published hash, your current menu was not changed. echo got: %GOT% echo expected: %EXPECTED% del /f /q "%TEMP%\ii.Reborn.new.dll" >nul 2>nul exit /b 1 ) echo Verified. ech" (Indicator: " curl ") in Source: sample.bin, Observed string: " echo. echo Your menu is updating, please wait... echo. where curl >nul 2>nul if errorlevel 1 ( echo curl was not found on this PC, cannot update. exit /b 1 ) echo Downloading ii Reborn... curl -L -f -sS -o "%TEMP%\ii.Reborn.new.dll" "%URL%" if errorlevel 1 ( echo Download failed, your current menu was not changed. del /f /q "%TEMP%\ii.Reborn.new.dll" >nul 2>nul exit /b 1 ) set "GOT=" for /f "delims=" %%h in ('certutil -hashfile "%TEMP%\ii.Reborn.new.dll" SHA256 ^| findstr /r "^[0-9a-fA-F]*$"') do if not defined GOT set "GOT=%%h" if not defined GOT ( echo Could not verify the download, your current menu was not changed. del /f /q "%TEMP%\ii.Reborn.new.dll" >nul 2>nul exit /b 1 ) if /i not "%GOT%"=="%EXPECTED%" ( echo Download does not match the published hash, your current menu was not changed. echo got: %GOT% echo expected: %EXPECTED% del /f /q "%TEMP%\ii.Reborn.new.dll" >nul 2>nul exit /b 1 ) echo Verified. ech" (Indicator: "curl -") in Source: sample.bin3a:T431,Found string "Menu Dev - github.com/poopoovr" (Indicator: "github.com"; Source: "sample.bin"), Found string "https://github.com/" (Indicator: "github.com"; Source: "sample.bin"), Found string "https://github.com/poopoovr/fn/releases/download/1/fn" (Indicator: "github.com"; Source: "sample.bin"), Found string "Admin - github.com/corgisolutions" (Indicator: "github.com"; Source: "sample.bin"), Found string "https://github.com/iimenu/manifest/raw/refs/heads/main/menuversion.json" (Indicator: "github.com"; Source: "sample.bin"), Found string "https://github.com/iimenu/manifest/raw/refs/heads/main/api.json" (Indicator: "github.com"; Source: "sample.bin"), Found string "Founder - github.com/TheKing13245" (Indicator: "github.com"; Source: "sample.bin"), file/memory contains long string with (Indicator: "github.com"; Source: "sample.bin"), Found string "Menu Dev - github.com/noob123ii" (Indicator: "github.com"; Source: "sample.bin"), Found string "https://github.com/iimenu/manifest/raw/refs/heads/main/menustatus.json" (Indicator: "github.com"; Source: "sample.bin")3b:T445,"Menu Dev - github.com/poopoovr" (Indicator: "github.com"), "https://github.com/" (Indicator: "github.com"), "https://github.com/poopoovr/fn/releases/download/1/fn" (Indicator: "github.com"), "Admin - github.com/corgisolutions" (Indicator: "github.com"), "https://github.com/iimenu/manifest/raw/refs/heads/main/menuversion.json" (Indicator: "github.com"), "https://github.com/iimenu/manifest/raw/refs/heads/main/api.json" (Indicator: "github.com"), "Founder - github.com/TheKing13245" (Indicator: "github.com"), " 1.2.4 Compiled 2026-10-19T15:15:00Z This program comes with ABSOLUTELY NO WARRANTY; for details see `https://github.com/iimenu/project/GPL/WARRANTY` This is free software, and you are welcome to redistribute it under certain conditions; see `https://github.com/iimenu/project/GPL/REDISTRIBUTION` for details. " (Indicator: "github.com"), "Menu Dev - github.com/noob123ii" (Indicator: "github.com"), "https://github.com/iimenu/manifest/raw/refs/heads/main/menustatus.json" (Indicator: "github.com"), "cdn.discordapp.com" (Indicator: "discordapp.com")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"8d97412b2d1d6ec5b7f0ae3e5320106f2b9cc99dcc52399107cd2b4ae398c5dd","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793942542204,"unified_at":"2026-11-06T05:22:22.204Z","metadata":{"hashes":{"sha256":"8d97412b2d1d6ec5b7f0ae3e5320106f2b9cc99dcc52399107cd2b4ae398c5dd","sha1":"9161849690537fc2f0010f2c3907b10a0cfe7f8a","md5":"fa6ef5b452e7c494381bcf538bcac7a0"},"file_info":{"file_name":"8d97412b2d1d6ec5b7f0ae3e5320106f2b9cc99dcc52399107cd2b4ae398c5dd","file_type":["pedll","executable"],"file_type_id":"dll","file_size":4944384,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793942523000,"last_seen":1793942524000,"last_multi_scan":1793942524000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":19,"suspicious_count":0,"malicious_count":0,"total":19},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"RiskWare/MSIL.Gamehack","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.110572","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.110572 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/GameHack_AGen.ES potentially unsafe application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Yogi.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Contains ability to retrieve remote user information"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to find string content in a file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$38","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://raw.githubusercontent.com\", Found HTTPS url \"https://github.com\", Found HTTPS url \"https://api\", Found HTTPS url \"https://.mat\", Found HTTPS url \"https://www.myinstants.com\", Found HTTPS url \"https://myinstants\", Found HTTPS url \"https://lazypy.ro\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping Name Tags\" (Indicator: \"ping \"; Source: \"sample.bin\"), Found string \"Ping Spoof\" (Indicator: \"ping \"; Source: \"sample.bin\"), Found string \"Ping Overlay\" (Indicator: \"ping \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$39","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-576","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.2.4.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Ping Name Tags\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Displays the server's ping on your screen.\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Ping Spoof\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Change Ping Spoof Value [200]\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Changes the ping of the \"Fake Lag\" mod.\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Ping Overlay\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \" Ping\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Forces your ping to be high.\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Changes the target ping for the Ping Spoof mod.\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"file/memory contains long string with (Indicator: \"findstr \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1552","id":"string-334","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Cannot send a presence with secrets as this object has not registered a URI scheme. Please enable the uri scheme registration in the DiscordRpcClient constructor.\" (Indicator: \"secret\"; Source: \"sample.bin\"), Found string \"The presence has set the secrets but no buttons will show as there is no party available.\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where is\" (Indicator: \"where \"; Source: \"sample.bin\"), Found string \"where are\" (Indicator: \"where \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Quota\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-688","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$3b","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\"), Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"Not an EC public key\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"Public key point is not on the P-256 curve\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"Public key not imported\" (Indicator: \"public key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"Observed string: \"No Finger Movement\" (Indicator: \" finger \") in Source: sample.bin, Observed string: \"Sends you a notification if there is a Finger Painter, Illustrator, Administrator, Stick, Forest Guide, or Another Axiom Creator in your room.\" (Indicator: \" finger \") in Source: sample.bin, Observed string: \"Shows icons above people's heads if they are a Finger Painter, Illustrator, Administrator, Stick, Forest Guide, or Another Axiom Creator.\" (Indicator: \" finger \") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-579","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown Headset Gun\" (Indicator: \"shutdown \") in Source: sample.bin, Observed string: \"Shutdown Headset All\" (Indicator: \"shutdown \") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Malicious Yogi.Generic Sample 8d97412b2d1d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8d97412b2d1d…. Malware family: Yogi.Generic. Threat score 100/100. 4/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8d97412b2d1d6ec5b7f0ae3e5320106f2b9cc99dcc52399107cd2b4ae398c5dd"}],["$","meta","4",{"property":"og:title","content":"Malicious Yogi.Generic Sample 8d97412b2d1d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8d97412b2d1d…. Malware family: Yogi.Generic. Threat score 100/100. 4/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8d97412b2d1d6ec5b7f0ae3e5320106f2b9cc99dcc52399107cd2b4ae398c5dd"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Yogi.Generic Sample 8d97412b2d1d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8d97412b2d1d…. Malware family: Yogi.Generic. Threat score 100/100. 4/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]] 32:null