24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Cerbu.Generic Sample a23476654f04… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a23476654f04…. Malware family: Cerbu.Generic. Threat score 100/100. 7/27 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24","keywords":["Malicious","Cerbu.Generic","malware analysis","sandbox report","threat intelligence","a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24"],"about":{"@type":"SoftwareApplication","name":"a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Cerbu.Generic","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T78f,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp, 00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp")26:T516,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp")27:Tcc9,Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp")28:Te77,Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMAC"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "HMACSHA512" (Indicator: "SHA512"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp")29:T8da,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp")2a:Tf7e,Assembly shows XOR instruction xor rax rsp in Stream UID: 59116-1404-000000014003D260 Assembly shows XOR instruction xor eax esp in Stream UID: 59116-1404-000000014003D260 Assembly shows XOR instruction xor rcx rsp in Stream UID: 59116-1404-000000014003D260 Assembly shows XOR instruction xor ecx esp in Stream UID: 59116-1404-000000014003D260 Assembly shows XOR instruction xor rax rsp in Stream UID: 59116-1523-000000014004D790 Assembly shows XOR instruction xor eax esp in Stream UID: 59116-1523-000000014004D790 Assembly shows XOR instruction xor rcx rsp in Stream UID: 59116-1523-000000014004D790 Assembly shows XOR instruction xor ecx esp in Stream UID: 59116-1523-000000014004D790 Assembly shows XOR instruction xor rax rsp in Stream UID: 59116-1525-000000014004D170 Assembly shows XOR instruction xor eax esp in Stream UID: 59116-1525-000000014004D170 Assembly shows XOR instruction xor rcx rsp in Stream UID: 59116-1525-000000014004D170 Assembly shows XOR instruction xor ecx esp in Stream UID: 59116-1525-000000014004D170 Assembly shows XOR instruction xor rax rsp in Stream UID: 59116-1526-000000014004CF90 Assembly shows XOR instruction xor eax esp in Stream UID: 59116-1526-000000014004CF90 Assembly shows XOR instruction xor rcx rsp in Stream UID: 59116-1526-000000014004CF90 Assembly shows XOR instruction xor ecx esp in Stream UID: 59116-1526-000000014004CF90 Assembly shows XOR instruction xor rax rsp in Stream UID: 59116-1527-000000014004CDA0 Assembly shows XOR instruction xor eax esp in Stream UID: 59116-1527-000000014004CDA0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 59116-1527-000000014004CDA0 Assembly shows XOR instruction xor ecx esp in Stream UID: 59116-1527-000000014004CDA0 Assembly shows XOR instruction xor rax rsp in Stream UID: 59116-1580-0000000140044FA0 Assembly shows XOR instruction xor eax esp in Stream UID: 59116-1580-0000000140044FA0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 59116-1580-0000000140044FA0 Assembly shows XOR instruction xor ecx esp in Stream UID: 59116-1580-0000000140044FA0 Assembly shows XOR instruction xor rax rsp in Stream UID: 59116-1582-0000000140044D80 Assembly shows XOR instruction xor eax esp in Stream UID: 59116-1582-0000000140044D80 Assembly shows XOR instruction xor rcx rsp in Stream UID: 59116-1582-0000000140044D80 Assembly shows XOR instruction xor ecx esp in Stream UID: 59116-1582-0000000140044D80 Assembly shows XOR instruction xor rcx rsp in Stream UID: 59116-2286-000000014004614B Assembly shows XOR instruction xor ecx esp in Stream UID: 59116-2286-000000014004614B Assembly shows XOR instruction xor rcx rsp in Stream UID: 59116-2996-0000000140082288 Assembly shows XOR instruction xor ecx esp in Stream UID: 59116-2996-0000000140082288 Assembly shows XOR instruction xor rax rsp in Stream UID: 59116-3014-00000001400835CA Assembly shows XOR instruction xor eax esp in Stream UID: 59116-3014-00000001400835CA Assembly shows XOR instruction xor rcx rsp in Stream UID: 59116-3014-00000001400835CA Assembly shows XOR instruction xor ecx esp in Stream UID: 59116-3014-00000001400835CA Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 59116-4480-000000014008182D Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 59116-4480-000000014008182D Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 59116-4480-000000014008182D Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 59116-4480-000000014008182D Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 59116-4480-000000014008182D Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 59116-4480-000000014008182D Assembly shows XOR instruction xor rax rcx in Stream UID: 59116-4480-000000014008182D Assembly shows XOR instruction xor eax ecx in Stream UID: 59116-4480-000000014008182D2b:T45a,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains CRYPTO related strings Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Able to perform cryptographic operations Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm2c:T2887,Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 843264; code bytes = 30d0 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 921782; code bytes = 30d0 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 929736; code bytes = 30d0 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 13004; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 13150; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 31049; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 50026; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 50650; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 51289; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 51423; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 51493; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 70253; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 72333; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 175568; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 181247; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 183002; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 296055; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 527487; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 803323; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 13754; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 338799; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 338886; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 338951; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 370319; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 418159; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 418242; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 418303; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 670571; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 699860; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe" at offset 898152; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 843264; code bytes = 30d0 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 921782; code bytes = 30d0 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 929736; code bytes = 30d0 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 13004; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 13150; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 31049; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 50026; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 50650; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 51289; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 51423; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 51493; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 70253; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 72333; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 175568; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 181247; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 183002; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 296055; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 527487; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 803323; code bytes = 33c1 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 13754; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 338799; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 338886; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 338951; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 370319; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 418159; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 418242; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 418303; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 670571; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 699860; code bytes = 8030 Found XOR loop in file "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin.exe.bin" at offset 898152; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 843264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 921782; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 929736; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 13004; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 13150; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 31049; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 50026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 50650; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 51289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 51423; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 51493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 70253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 72333; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 175568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 181247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 183002; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 296055; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 527487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 803323; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 13754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 338799; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 338886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 338951; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 370319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418242; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418303; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 670571; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 699860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 898152; code bytes = 80302d:T1842,"" (Indicator: "base64"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "Rijndael" (Indicator: "rijndael"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp")34:T7d7,Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "a23476654f047a2f4a160d61cc511a0b660952e18f38825ddbebcb2ef7a1be24.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp, 00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to API "GetCurrentProcessorNumberEx" (Indicator: "GetCurrentProcess"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007280.00000000.259279.5D5A6000.00000002.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp")35:T559,Found string "passwordstorerc" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "*"password":"(.*?)"" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "server_user_password>" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "/server_user_password>" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "yncpassword" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "password>" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "/password>" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "k__BackingField" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "get_password" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "set_password" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp") Found string "passwordVaultPtr" (Indicator: "password"; Source: "00000000-00007280.00000000.259279.5E400000.00000004.mdmp")36:T5d2," HTTP/1.1 200 OK\nDate: Sat\n 25 Apr 2026 05:45:40 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 6\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>66616C73650A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69ec54c4848ca22b990e8e2d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"