26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 48:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T518,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Suspicious:Trojan.xPack.a.qobe.dll Sample 98d86be099dd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 98d86be099dd…. Malware family: Suspicious:Trojan.xPack.a.qobe.dll. Threat score 100/100. 4/28 AV engines flagged this file. 13 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/98d86be099dd339adebf2d9d761635652f5e8a854a9640e8114c3ae1ffbd7c85","keywords":["Malicious","Suspicious:Trojan.xPack.a.qobe.dll","malware analysis","sandbox report","threat intelligence","98d86be099dd339adebf2d9d761635652f5e8a854a9640e8114c3ae1ffbd7c85"],"about":{"@type":"SoftwareApplication","name":"98d86be099dd339adebf2d9d761635652f5e8a854a9640e8114c3ae1ffbd7c85.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"98d86be099dd339adebf2d9d761635652f5e8a854a9640e8114c3ae1ffbd7c85","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Suspicious:Trojan.xPack.a.qobe.dll","antivirusDetections":{"malicious":4,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T820," "{"api_token":"VT-5F35BB7F-6D5EAC04-5149D2E0-1CC37713","hwid":"FA49926A","timestamp":1782778226,"nonce":"FA49926A_336169266736","check":true,"lang":1033,"layout":1033}" HTTP/1.1 200 OK Date: Tue 30 Jun 2026 00:10:27 GMT Content-Type: application/json; charset=utf-8 Content-Length: 314 Connection: keep-alive Server: cloudflare Strict-Transport-Security: max-age=15552000; includeSubDomains Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Referrer-Policy: no-referrer Cross-Origin-Opener-Policy: same-origin Permissions-Policy: geolocation=() microphone=() camera=() payment=() X-Dns-Prefetch-Control: off Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net https://unpkg.com https://cdn.tailwindcss.com https://code.jquery.com https://code.highcharts.com https://cdnjs.cloudflare.com https://static.cloudflareinsights.com https://challenges.cloudflare.com https://cdn.jsdelivr.net/npm/apexcharts@3.54.1/dist/apexcharts.min.js; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://cdn.tailwindcss.com https://fonts.googleapis.com https://cdnjs.cloudflare.com https://unpkg.com; font-src 'self' https://fonts.gstatic.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com data:; img-src 'self' data: https: blob:; connect-src 'self' https://usevolta.su https://cdn.tailwindcss.com https://code.highcharts.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://cloudflareinsights.com https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self' Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Access-Control-Allow-Origin: https://usevolta.su Vary: Origin Accept-Encoding Access-Control-Allow-Credentials: true Etag: W/"13a-cQ8ekfH/dvYimlPubRWjwZUy1QY" Cf-Cache-Status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=pEhCC2OBErG3L8ZqyKpc3qYcjYhLqQYjFT7F%2Bobf6eNWdQH6c3rsxjl8HvH69H1ETN4wOO4aqr6pr3fl9CJ6qMKlUQcioU8P6SXKzmD7GpBoGsMUTycD%2Bn1qmWFZoQ%3D%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: a138f2afae2798ce-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22616C6C6F776564223A747275652C2268776964223A224641343939323641222C227473223A313738323737383232372C226E6F6E6365223A224641343939.......43:Tb82,Process "chrome.exe" with commandline "--headless=new --disable-gpu --no-sandbox" (UID: 00000000-00001564) Process "chrome.exe" with commandline "--type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="%TEMP%\\HeadlessChrome15644554640" --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1936,i,8659273350791860930,3824165488368527497,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1928 /prefetch:2" (UID: 00000000-00003540) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="%TEMP%\\HeadlessChrome15644554640" --no-pre-read-main-dll --field-trial-handle=1936,i,8659273350791860930,3824165488368527497,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=3788 /prefetch:3" (UID: 00000000-00008152) Process "chrome.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="%TEMP%\\HeadlessChrome15644554640" --no-pre-read-main-dll --field-trial-handle=1936,i,8659273350791860930,3824165488368527497,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3848 /prefetch:8" (UID: 00000000-00007772) Process "msedge.exe" with commandline "--headless=new --disable-gpu --no-sandbox" (UID: 00000000-00006260) Process "msedge.exe" with commandline "--type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="%TEMP%\\HeadlessEdge62604558937" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --startup-read-main-dll --field-trial-handle=2252,i,3664191395816246040,9719451306469054268,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2248 /prefetch:2" (UID: 00000000-00007148) Process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="%TEMP%\\HeadlessEdge62604558937" --startup-read-main-dll --field-trial-handle=2252,i,3664191395816246040,9719451306469054268,262144 --disable-features=PaintHolding --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=3836 /prefetch:3" (UID: 00000000-00004144)44:Tbac,"\" (Indicator: \"SHA512\"; Source: \"00000000-00001564.00000000.291698.1717D000.00000002.mdmp, 00000000-00001564.00000000.291698.69EF7000.00000002.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00001564.00000000.291698.5A050000.00000004.mdmp, 00000000-00001564.00000000.291698.5DAC0000.00000004.mdmp\")\n Found reference to \"rtificate: CertificateUtil::FindAllCertificatesByOidValue didn't find any certificate so returning CRYPT_E_NOT_FOUND.\" (Indicator: \"Oid\"; Source: \"00000000-00001564.00000000.291698.5A050000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"RC2\"; Source: \"00000000-00001564.00000000.291698.5A050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$28","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$29","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00000356-00000C2B-3545783787\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00001564.00000000.291698.57F20000.00000040.mdmp, 00000000-00001564.00000000.291698.5A020000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.88461","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2b","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 35597; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 64319; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 2729; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 61416; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 73312; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 81848; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"Found string \"%PROGRAMFILES%\\Oracle\\VirtualBox Guest Additions\\*\" (Source: \"00000000-00000356-00000C2C-8654057739\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"::GetUserNameW\" (Source: \"00000000-00001564.00000000.291698.1717D000.00000002.mdmp, 00000000-00001564.00000000.291698.69EF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00001564.00000000.291698.01440000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00001564.00000000.291698.01440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; Source: \"00000000-00000356-00000C2B-3545372792\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000356-00000C2B-3545372270\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001564.00000000.291698.1717D000.00000002.mdmp, 00000000-00001564.00000000.291698.69EF7000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001564.00000000.291698.1717D000.00000002.mdmp, 00000000-00001564.00000000.291698.69EF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"::WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00001564.00000000.291698.1717D000.00000002.mdmp, 00000000-00001564.00000000.291698.69EF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001564.00000000.291698.1717D000.00000002.mdmp, 00000000-00001564.00000000.291698.69EF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"chrome://settings/cookies\" (Indicator: \"/cookies\"; Source: \"00000000-00001564.00000000.291698.00CF4000.00000004.mdmp, 00000000-00001564.00000000.291698.01030000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00000356-00000C2B-3545500621\")\n Found reference to API \"runtime.sendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00001564.00000000.291698.005A4000.00000004.mdmp, 00000000-00001564.00000000.291698.0088C000.00000004.mdmp, 00000000-00001564.00000000.291698.008C0000.00000004.mdmp\")\n Found reference to API \"test.sendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00001564.00000000.291698.0078C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" \"{\"api_token\":\"VT-5F35BB7F-6D5EAC04-5149D2E0-1CC37713\",\"hwid\":\"FA49926A\",\"timestamp\":1782778226,\"nonce\":\"FA49926A_336169266736\",\"check\":true,\"lang\":1033,\"layout\":1033}\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"6a43095b3c9268c8850ea3f9"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"\"