26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.naKocTb Sample 8f69af0fce0c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8f69af0fce0c…. Malware family: Trojan.naKocTb. Threat score 100/100. 25/28 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4","keywords":["Malicious","Trojan.naKocTb","malware analysis","sandbox report","threat intelligence","8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4"],"about":{"@type":"SoftwareApplication","name":"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin","applicationCategory":["peexe","executable"],"identifier":"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.naKocTb","antivirusDetections":{"malicious":25,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T458,Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; File: "8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp")28:T4f6,"" (Indicator: "GetDC"; Source: "00000000-00007248.00000000.106956.02B20000.00000004.mdmp, 00000000-00007248.00000001.108793.02B20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007248.00000000.106956.02B20000.00000004.mdmp, 00000000-00007248.00000001.108793.02B20000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007248.00000000.106956.02B20000.00000004.mdmp, 00000000-00007248.00000001.108793.02B20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007248.00000000.106956.02B20000.00000004.mdmp, 00000000-00007248.00000001.108793.02B20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007248.00000000.106956.02B20000.00000004.mdmp, 00000000-00007248.00000001.108793.02B20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007248.00000000.106956.02B20000.00000004.mdmp, 00000000-00007248.00000001.108793.02B20000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007248.00000000.106956.02B20000.00000004.mdmp, 00000000-00007248.00000001.108793.02B20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007248.00000000.106956.02B20000.00000004.mdmp, 00000000-00007248.00000001.108793.02B20000.00000004.mdmp")39:Ta80,"%s\Thunderbird\profiles.ini" in Source: 8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin "%s\Thunderbird\Profiles\%s" in Source: 8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin "%s\Postbox\profiles.ini" in Source: 8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin "%s\Postbox\Profiles\%s" in Source: 8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin "SOFTWARE\Postbox\Postbox" in Source: 8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin "%s\Foxmail\mail" in Source: 8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook" in Source: 8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook" in Source: 8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin "WARE\Postbox\Postbox" in Source: 8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin "e\16.0\Outlook\Profiles\Outlook" in Source: 8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin "\Outlook\Profiles\Outlook" in Source: 00000000-00007248.00000001.108793.00415000.00000004.mdmp "%s\Thunderbird\profiles.ini" in Source: 00000000-00007248.00000000.106956.00415000.00000004.mdmp 00000000-00007248.00000001.108793.00415000.00000004.mdmp "%s\Thunderbird\Profiles\%s" in Source: 00000000-00007248.00000000.106956.00415000.00000004.mdmp 00000000-00007248.00000001.108793.00415000.00000004.mdmp "%s\Postbox\profiles.ini" in Source: 00000000-00007248.00000000.106956.00415000.00000004.mdmp 00000000-00007248.00000001.108793.00415000.00000004.mdmp "%s\Postbox\Profiles\%s" in Source: 00000000-00007248.00000000.106956.00415000.00000004.mdmp 00000000-00007248.00000001.108793.00415000.00000004.mdmp "SOFTWARE\Postbox\Postbox" in Source: 00000000-00007248.00000000.106956.00415000.00000004.mdmp 00000000-00007248.00000001.108793.00415000.00000004.mdmp "%s\Foxmail\mail" in Source: 00000000-00007248.00000000.106956.00415000.00000004.mdmp 00000000-00007248.00000001.108793.00415000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook" in Source: 00000000-00007248.00000000.106956.00415000.00000004.mdmp 00000000-00007248.00000001.108793.00415000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook" in Source: 00000000-00007248.00000000.106956.00415000.00000004.mdmp 00000000-00007248.00000001.108793.00415000.00000004.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002" in Source: 00000000-00007248.00000001.108793.02B20000.00000004.mdmp3a:T4e3,Found string "SELECT encryptedUsername, encryptedPassword, formSubmitURL, hostname FROM moz_logins" (Indicator: "hostname"; File: "8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin") Found string "hostname" (Indicator: "hostname"; File: "8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin") Found string "HostName" (Indicator: "hostname"; File: "8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin") Found string "ncryptedUsername, encryptedPassword, formSubmitURL, hostname FROM moz_logins" (Indicator: "hostname"; File: "8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin") Found string "HostName" (Indicator: "hostname"; Source: "00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp") Found string "SELECT encryptedUsername, encryptedPassword, formSubmitURL, hostname FROM moz_logins" (Indicator: "hostname"; Source: "00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp")3b:T8b8,"%s\Estsoft\ALFTP\ESTdb2.dat" (Indicator: "\estsoft\alftp") "%s\Estsoft\ALFTP\ESTdb2.dat" (Indicator: "estdb2.dat") "%s\BitKinex\bitkinex.ds" (Indicator: "\bitkinex") "%s\BitKinex\bitkinex.ds" (Indicator: "bitkinex.ds") "%s\BlazeFtp\site.dat" (Indicator: "site.dat") "%s\BlazeFtp\site.dat" (Indicator: "blazeftp") "Software\FlashPeak\BlazeFtp\Settings" (Indicator: "blazeftp") "Software\FlashPeak\BlazeFtp\Settings" (Indicator: "software\flashpeak\blazeftp\settings") "Software\NCH Software\ClassicFTP\FTPAccounts" (Indicator: "software\nch software\classicftp\ftpaccounts") "%s\Cyberduck" (Indicator: "\cyberduck") "*quick.dat" (Indicator: "quick.dat") "Software\NCH Software\Fling\Accounts" (Indicator: "software\nch software\fling\accounts") "%s\FreshWebmaster\FreshFTP\FtpSites.SMF" (Indicator: "freshftp") "%s\FTPGetter\Profile\servers.xml" (Indicator: "\ftpgetter") "%s\FTPGetter\servers.xml" (Indicator: "\ftpgetter") "%s\FTPInfo\ServerList.xml" (Indicator: "ftpinfo") "%s\FTPInfo\ServerList.cfg" (Indicator: "ftpinfo") "%s\FTP Navigator\Ftplist.txt" (Indicator: "ftp navigator") "%s\FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "%s\FTP Now\sites.xml" (Indicator: "\sites.xml") "%s\FTP Now\sites.xml" (Indicator: "ftp now") "%s\FTPShell\ftpshell.fsi" (Indicator: "ftpshell") "%s\FTPShell\ftpshell.fsi" (Indicator: "ftpshell.fsi") "%s\DeluxeFTP\sites.xml" (Indicator: "\sites.xml") "%s\GoFTP\settings\Connections.txt" (Indicator: "connections.txt") "%s\GoFTP\settings\Connections.txt" (Indicator: "goftp") "%s\NetDrive\NDSites.ini" (Indicator: "\netdrive") "%s\NetDrive\NDSites.ini" (Indicator: "ndsites.ini") "%s\NetDrive\NDSites.ini" (Indicator: "sites.ini") "%s\NetDrive2\drives.dat" (Indicator: "\netdrive") "%s\NexusFile\userdata\ftpsite.ini" (Indicator: "ftpsite.ini") "%s\NexusFile\userdata\ftpsite.ini" (Indicator: "nexusfile") "%s\NexusFile\ftpsite.ini" (Indicator: "ftpsite.ini") "%s\NexusFile\ftpsite.ini" (Indicator: "nexusfile") "%s\INSoftware\NovaFTP\NovaFTP.db" (Indicator: "\insoftware\novaftp") "%s\INSoftware\NovaFTP\NovaFTP.db" (Indicator: "novaftp.db") "Software\VanDyke\SecureFX" (Indicator: "software\vandyke\securefx") "%s\SmartFTP" (Indicator: "\smartftp")3c:Ta00,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007248.00000000.106956.02B20000.00000004.mdmp, 00000000-00007248.00000001.108793.02B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin\")\n Found reference to API \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinaryA\"; File: \"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin\")\n Found api reference \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin\")\n Found api reference \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinaryA\"; Source: \"00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp\")\n Found api reference \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp\")\n Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00007248.00000000.106956.02B20000.00000004.mdmp\")\n Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007248.00000000.106956.02B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin\")\n Found reference to API \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007248.00000000.106956.02B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"%s\\nss3.dll\" (Indicator: \"\\nss3.dll\"; File: \"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin\")\n Found string \"%s\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Calls an API typically used to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: Reads the cryptographic machine GUID","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName\" (Source: \"00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp\")\n Found string \"FtpUserName\" (Source: \"00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00007248.00000000.106956.02B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in file \"8f69af0fce0ccbacb9fac1d2ba551ff3982336700ebb59280c0b1b09a637c4f4.bin\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00007248.00000000.106956.00415000.00000004.mdmp, 00000000-00007248.00000001.108793.00415000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007248.00000000.106956.02B20000.00000004.mdmp, 00000000-00007248.00000001.108793.02B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6973393ce3efa0b9550a1671"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"