25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:T2d26,Pattern match: "https://www.php.net/manual/en/function.file-get-contents.php", Pattern match: "https://www.php.net/manual/en/ref.pdo-mysql.php", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.x86_64.deb\ndpkg", Pattern match: "https://github.githubassets.com/assets/pinned-octocat-093da3e6fa40.svg", Pattern match: "https://pear.php.net/package/http_request2", Pattern match: "https://github.com/pricing", Pattern match: "https://www.php.net/manual/en/book.pgsql.php\", Pattern match: "https://avatars.githubusercontent.com/u/110776285?s=60&v=4", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.x86_64.deb", Pattern match: "https://github.com/features/ai", Pattern match: "ithubassets.com/assets/a6j.79efa24b091c8a5d.module.css", Pattern match: "https://github.com/about", Pattern match: "https://github.blog/", Pattern match: "https://schema.org/abstract", Pattern match: "https://www.githubstatus.com/", Pattern match: "https://github.githubassets.com/assets/react-core-42187993590d61e8.js", Pattern match: "https://help.aikido.dev/zen-firewall/zen-features/attack-wave-protection", Pattern match: "https://help.github.com/", Pattern match: "https://github.githubassets.com/assets/to-b501df3e06c1799a.js", Pattern match: "https://github.com/security/advanced-security/se", Pattern match: "https://www.php.net/manual/en/ref.pdo-firebird.php", Pattern match: "https://github.com/trending", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.${arch}.apk\u0026quot;\napk", Pattern match: "https://github.com/features/copilot", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.aarch64.deb\ndpkg", Pattern match: "https://github.githubassets.com/assets/light_high_contrast-9c7b506bdc5ea73f.css", Pattern match: "https://github.com/solutions/industry/government", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.${arch}.apk"", Pattern match: "https://www.php.net/manual/en/book.pgsql.php", Pattern match: "https://avatars.githubusercontent.com/u/110776285?s=400&v=4", Pattern match: "https://app.intigriti.com/researcher/programs/aikido/aikidoruntime", Pattern match: "https://github.com/security/advanced-security/code-security", Pattern match: "https://www.php.net/manual/en/book.curl.php\", Pattern match: "https://github.com", Pattern match: "https://github.githubassets.com/assets/h4-5f55e06e297293d6.js", Pattern match: "https://docs.github.com/en", Pattern match: "https://aikido.dev/zen,topics:[],showinsights:true,canopenstargazersandwatchers:false,stargazercount:161,watchercount:8,forkscount:16,stargazerspath:/aikidosec/firewall-php/stargazers,watcherspath:/aikidosec/firewall-php/watchers,fork", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.aarch64.deb", Pattern match: "https://github.githubassets.com/assets/app-install-banner-partial.812385e17931d62f.module.css", Pattern match: "https://github.blog/changelog/", Pattern match: "https://github.githubassets.com/assets/keyboard-shortcuts-dialog.b6ef261861a85e2f.module.css", Pattern match: "https://github.com/features", Pattern match: "https://www.php.net/manual/en/book.pdo.php\", Pattern match: "https://github.com/features/codespaces", Pattern match: "https://github.com/resources", Pattern match: "https://github.com/features/actions", Pattern match: "https://github.githubassets.com/", Pattern match: "https://github.com/aikidosec/firewall-php", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.aarch64.rpm", Pattern match: "https://www.php.net/manual/en/ref.pdo-pgsql.php\", Pattern match: "https://www.php.net/manual/en/ref.pdo-sqlite.php", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.x86_64.rpm", Pattern match: "https://github.githubassets.com/assets/global-nav-bar-a0f24c316f59cd8e.js", Pattern match: "https://github.githubassets.com/assets/0r-4a2b771052825f69.js", Pattern match: "https://www.aikido.dev/blog/command-injection-in-2024-unpacked\", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5", Pattern match: "https://www.aikido.dev/blog/command-injection-in-2024-unpacked", Pattern match: "https://www.php.net/manual/en/ref.pdo-odbc.php", Pattern match: "https://github.githubassets.com/assets/light_colorblind_high_contrast-554f83c57e146400.css", Pattern match: "https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-copilot-overview", Pattern match: "https://owasp.org/www-community/attacks/path_traversal", Pattern match: "https://www.php.net/manual/en/ref.pdo-sqlite.php\", Pattern match: "https://learn.github.com/credentials", Pattern match: "https://api.githubcopilot.com},search:{show:true,showcommandpalette:false,issearchpage:false,isjumptosearch:false,searchcontext:{scope:repo:aikidosec/firewall-php,c", Pattern match: "https://github.githubassets.com/assets/c28-f878d90b996626ad.js", Pattern match: "https://github.githubassets.com/assets/0b-a7be65069037ffea.js", Pattern match: "ub.githubassets.com/assets/dark_dimmed_high_contrast-bb55737dcb13dc9b.css", Pattern match: "https://github.com/enterprise/premium-support", Pattern match: "https://www.php.net/manual/en/book.mysqli.php", Pattern match: "ub.githubassets.com/assets/code-b25a4886e30e3e5f.css", Pattern match: "https://github.com/solutions/industry/financial-services", Pattern match: "https://github.com/aikidosec/firewall-php","user_id":null", Pattern match: "https://www.aikido.dev/blog/the-state-of-sql-injections\", Pattern match: "https://github.com/marketplace", Pattern match: "https://github.githubassets.com/assets/z8j-d8f6fa7339115370.js", Pattern match: "https://help.aikido.dev/doc/configuration-via-env-vars/docrsituker9\", Pattern match: "https://github.githubassets.com/assets/changelog-fd687bff072883b0.png", Pattern match: "https://learn.github.com/skills", Pattern match: "https://app.aikido.dev/login", Pattern match: "https://github.githubassets.com/assets/dark_colorblind-bea0b289618fbfb6.css", Pattern match: "https://app.aikido.dev/login\", Pattern match: "https://api.github.com/_private/browser/stats", Pattern match: "https://www.php.net/manual/en/ref.pdo-dblib.php", Pattern match: "https://www.php.net/manual/en/book.mysqli.php\", Pattern match: "https://github.githubassets.com/assets/mlz-fce49bd96df2c99f.js", Pattern match: "https://avatars.githubusercontent.com/u/110776285?v=4,public:true,private:false,isorgowned:true,isarchived:false},currentuser:null,uploadtoken:znx5hhehypotla2efdrof03wiiyyikxcoeybligzu22fposhu0-5zgzqowlqhx0bkiwgevgvrb5fltr72sidca,allshortcu", Pattern match: "https://github.com/fluidicon.png", Pattern match: "https://github.githubassets.com/assets/react-compiler-runtime-4610bd6d3de9c049.js", Pattern match: "https://github.githubassets.com", Pattern match: "github.githubassets.com/assets/fm-143e0270bb41781f.js", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.${arch}.apk\\napk", Pattern match: "https://www.aikido.dev/blog/the-state-of-sql-injections", Pattern match: "https://aikido.dev/zen", Pattern match: "https://docs.guzzlephp.org/en/stable/", Pattern match: "https://github.githubassets.com/assets/app-runtime.0348544a16287601.module.css", Pattern match: "https://owasp.org/www-community/attacks/path_traversal\", Pattern match: "https://www.php.net/manual/en/ref.pdo-oci.php\", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.aarch64.rpm\\u003e\u003cpre", Pattern match: "https://help.aikido.dev/zen-firewall/zen-features/attack-wave-protection\", Pattern match: "http://schema.org/softwaresourcecode", Pattern match: "https://www.php.net/manual/en/ref.pdo-odbc.php\", Pattern match: "https://github.com/features/code-quality", Pattern match: "https://github.com/team", Pattern match: "https://api.github.com/cmc_internal/api", Pattern match: "https://www.php.net/manual/en/ref.pdo-mysql.php\", Pattern match: "https://github.com/solutions/industry/healthcare", Pattern match: "https://www.php.net/manual/en/book.sqlite3.php\", Pattern match: "https://github.githubassets.com/assets/platform-4ce65ae0bf273ce2.png/", Pattern match: "https://github.com/security/advanced-security", Pattern match: "https://www.php.net/manual/en/ref.pdo-dblib.php\", Pattern match: "https://www.php.net/manual/en/book.oci8.php\", Pattern match: "https://github.com/trust-center", Pattern match: "https://www.php.net/manual/en/book.pdo.php", Pattern match: "https://github.githubassets.com/assets/n9-369bc13c0e8c5584.js", Pattern match: "https://github.com/aikidosec/firewall-php.git,showclonewarning:null,sshurl:null,sshcertificatesrequired:null,sshcertificatesavailable:null,ghcliurl:gh", Pattern match: "github.com/aikidosec/firewall-php", Pattern match: "https://githubuniverse.com/", Pattern match: "https://www.php.net/manual/en/book.curl.php", Pattern match: "https://github.githubassets.com/assets/5w-452c3a937483ff49.js", Pattern match: "https://github.githubassets.com/assets/9m-6b203be6a68b3fa3.js", Pattern match: "github.com/why-github", Pattern match: "https://github.githubassets.com/assets/platform-dark-ac89fbf373737ed3.png", Pattern match: "https://symfony.com/doc/current/http_client.html", Pattern match: "https://www.php.net/manual/en/book.sqlite3.php", Pattern match: "https://github.com/platform", Pattern match: "https://github.com/orgs/community/discussions", Pattern match: "https://github.githubassets.com/assets/code-view.09625fa73584674b.module.css", Pattern match: "https://support.github.com?tags=dotcom-footer", Pattern match: "https://github.com/aikidosec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.x86_64.rpm\\u003e\u003cpre", Pattern match: "https://docs.guzzlephp.org/en/stable/\", Pattern match: "https://www.php.net/manual/en/book.oci8.php", Pattern match: "https://app.intigriti.com/researcher/programs/aikido/aikidoruntime\", Pattern match: "https://docs.github.com/site-policy/github-terms/github-terms-of-service", Pattern match: "https://github.com,copilotapioverrideurl:https://api.githubcopilot.com,cmcapiurl", Pattern match: "https://www.php.net/manual/en/ref.pdo-oci.php", Pattern match: "https://github.githubassets.com/assets/universe-a98cd54821b27569.png", Pattern match: "https://github.com/enterprise", Pattern match: "https://www.php.net/manual/en/ref.pdo-firebird.php\", Pattern match: "https://help.aikido.dev/doc/configuration-via-env-vars/docrsituker9", Pattern match: "https://pear.php.net/package/http_request2\", Pattern match: "https://symfony.com/doc/current/http_client.html\", Pattern match: "https://avatars.githubusercontent.com/u/110776285?s=60&v=4/", Pattern match: "https://www.php.net/manual/en/function.file-get-contents.php\", Pattern match: "https://github.com/features/copilot/copilot-business", Pattern match: "https://github.githubassets.com/assets/g4-05e4d33e43f27775.js", Pattern match: "https://github.githubassets.com/assets/react-is-e0b593954b4706d8.js,react-reconciler:https://github.githubassets.com/assets/react-reconciler-8e99e505c4429605.js,react/compiler-runtime:https://github.githubassets.com/assets/react-compiler-runtime-46", Pattern match: "https://www.php.net/manual/en/ref.pdo-pgsql.php"27:T447,Found HTTPS url "https://www.php.net", Found HTTPS url "https://github.com", Found HTTPS url "https://github.githubassets.com", Found HTTPS url "https://pear.php.net", Found HTTPS url "https://avatars.githubusercontent.com", Found HTTPS url "https://github.blog", Found HTTPS url "https://schema.org", Found HTTPS url "https://www.githubstatus.com", Found HTTPS url "https://help.aikido.dev", Found HTTPS url "https://help.github.com", Found HTTPS url "https://app.intigriti.com", Found HTTPS url "https://github.g", Found HTTPS url "https://docs.github.com", Found HTTPS url "https://aikido.dev", Found HTTPS url "https://collector.github.com", Found HTTPS url "https://www.aikido.dev", Found HTTPS url "https://owasp.org", Found HTTPS url "https://learn.github.com", Found HTTPS url "https://api.githubcopilot.com", Found HTTPS url "https://gith", Found HTTPS url "https://app.aikido.dev", Found HTTPS url "https://api.github.com", Found HTTPS url "https://github.githubassets.", Found HTTPS url "https://github", Found HTTPS url "https://user", Found HTTPS url "https://github.githubassets.c"28:T3564,Observed string: "3c/svg\u003e\u003c/a\u003e\u003c/div\u003e\n\u003cdiv class=\"snippet-clipboard-content notranslate position-relative overflow-auto\" data-snippet-clipboard-copy-content=\"curl -L -O https://github.com/AikidoSec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.x86_64.deb\ndpkg -i -E ./aikido-php-firewall.x86_64.deb\"\u003e\u003cpre class=\"notranslate\"\u003e\u003ccode\u003ecurl -L -O https://github.com/AikidoSec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.x86_64.deb\ndpkg -i -E ./aikido-php-firewall.x86_64.deb\n\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\n\u003cdiv class=\"markdown-heading\" dir=\"auto\"\u003e\u003ch5 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\"\u003earm64 / aarch64\u003c/h5\u003e\u003ca id=\"user-content-arm64--aarch64-1\" class=\"anchor\" aria-label=\"Permalink: arm64 / aarch64\" href=\"#arm64--aarch64-1\"\u003e\u003csvg data-component=\"Octicon\" class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hi" (Indicator: ""curl") in Source: sample.bin, Observed string: "3c/svg\u003e\u003c/a\u003e\u003c/div\u003e\n\u003cdiv class=\"snippet-clipboard-content notranslate position-relative overflow-auto\" data-snippet-clipboard-copy-content=\"curl -L -O https://github.com/AikidoSec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.x86_64.deb\ndpkg -i -E ./aikido-php-firewall.x86_64.deb\"\u003e\u003cpre class=\"notranslate\"\u003e\u003ccode\u003ecurl -L -O https://github.com/AikidoSec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.x86_64.deb\ndpkg -i -E ./aikido-php-firewall.x86_64.deb\n\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\n\u003cdiv class=\"markdown-heading\" dir=\"auto\"\u003e\u003ch5 tabindex=\"-1\" class=\"heading-element\" dir=\"auto\"\u003earm64 / aarch64\u003c/h5\u003e\u003ca id=\"user-content-arm64--aarch64-1\" class=\"anchor\" aria-label=\"Permalink: arm64 / aarch64\" href=\"#arm64--aarch64-1\"\u003e\u003csvg data-component=\"Octicon\" class=\"octicon octicon-link\" viewBox=\"0 0 16 16\" version=\"1.1\" width=\"16\" height=\"16\" aria-hi" (Indicator: "curl -") in Source: sample.bin, Observed string: ".31/aikido-php-firewall.x86_64.deb dpkg -i -E ./aikido-php-firewall.x86_64.deb">

curl -L -O https://github.com/AikidoSec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.x86_64.deb
dpkg -i -E ./aikido-php-firewall.x86_64.deb

arm64 / aarch64

ARCH="$(uname -m)"
curl -L -O "https://github.com/AikidoSec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.${ARCH}.apk"
apk add --allow-untrusted "./aikido-php-firewall.${ARCH}.apk"

The APK is distributed as a standalone package, so its signing key is not installed in Alpine. This is why --allow-untrusted is required.

Deployment setup

curl -L -O https://github.com/AikidoSec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.aarch64.deb
dpkg -i -E ./aikido-php-firewall.aarch64.deb

We support Debian >= 11 and Ubuntu >= 20.04. You can run on Debian 10, by doing this setup before install: Debian10 setup

For Alpine Linux (beta)

curl -L -O https://github.com/AikidoSec/firewall-php/releases/download/v1.5.31/aikido-php-firewall.aarch64.deb
dpkg -i -E ./aikido-php-firewall.aarch64.deb

We support Debian >= 11 and Ubuntu >= 20.04. You can run on Debian 10, by doing this setup before install: Debian10 setup

For Alpine Linux (beta)

x86_64

cURL

Including wrappers, when configured to use cURL as adapter:
- " (Indicator: " curl ") in Source: sample.bin1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample aad946afc23b… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample aad946afc23b…. Threat score 0/100. 0/23 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/aad946afc23bc1923288bb493f13a485125c6a501081b6b7466a535e48ef51c5\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"aad946afc23bc1923288bb493f13a485125c6a501081b6b7466a535e48ef51c5\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"urlref_httpsgithub.comAikidoSecfirewall-php\",\"applicationCategory\":[\"html\"],\"identifier\":\"aad946afc23bc1923288bb493f13a485125c6a501081b6b7466a535e48ef51c5\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":23},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L25",null,{"initialData":{"schema_version":"1.0.15","sha256":"aad946afc23bc1923288bb493f13a485125c6a501081b6b7466a535e48ef51c5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793624621213,"unified_at":"2026-11-02T13:03:41.213Z","metadata":{"hashes":{"sha256":"aad946afc23bc1923288bb493f13a485125c6a501081b6b7466a535e48ef51c5","sha1":"6e7596ad4faa3d23e5a00245509d938b0b069bff","md5":"087df95111d11f52963a4cdf781532b4"},"file_info":{"file_name":"urlref_httpsgithub.comAikidoSecfirewall-php","file_type":["html"],"file_type_id":"html","file_size":366676,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793624614000,"last_seen":1793624614000,"last_multi_scan":1793624614000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":10,"suspicious_count":0,"malicious_count":0,"total":10},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to enumerate files/folders on disk"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to download payload"},{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to download payload","description":"file/memory contains long string with (Indicator: \"curl\"; Source: \"sample.bin\"), Found string \" cURL\n
  - Including wrappers, when configured to use cURL as adapter:\n
    - \" (Indicator: \"curl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-10039","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"$28","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-576","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate files/folders on disk","description":"file/memory contains long string with (Indicator: \"_open\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-10033","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Oid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \" at runtime.\" />