26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mikey.Generic Sample b86c5634e278… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b86c5634e278…. Malware family: Mikey.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 7 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646","keywords":["Malicious","Mikey.Generic","malware analysis","sandbox report","threat intelligence","b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646"],"about":{"@type":"SoftwareApplication","name":"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mikey.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T596,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00005640.00000000.232463.64827000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00005640.00000000.232463.64827000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00005640.00000000.232463.64827000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00005640.00000000.232463.64827000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00005640.00000000.232463.64827000.00000002.mdmp")28:T5ca,Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; File: "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005640.00000000.232463.64827000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005640.00000000.232463.64827000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00005640.00000000.232463.64827000.00000002.mdmp") Found reference to API "Wow64SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00005640.00000000.232463.64827000.00000002.mdmp") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00005640.00000000.232463.64827000.00000002.mdmp")29:T742,Assembly shows XOR instruction xor rcx rsp in Stream UID: 24568-459-0000000140004568 Assembly shows XOR instruction xor ecx esp in Stream UID: 24568-459-0000000140004568 Assembly shows XOR instruction xor rax rsp in Stream UID: 24568-571-000000014000D282 Assembly shows XOR instruction xor eax esp in Stream UID: 24568-571-000000014000D282 Assembly shows XOR instruction xor rcx rsp in Stream UID: 24568-571-000000014000D282 Assembly shows XOR instruction xor ecx esp in Stream UID: 24568-571-000000014000D282 Assembly shows XOR instruction xor rax rsp in Stream UID: 24568-583-000000014000D7AF Assembly shows XOR instruction xor eax esp in Stream UID: 24568-583-000000014000D7AF Assembly shows XOR instruction xor rcx rsp in Stream UID: 24568-583-000000014000D7AF Assembly shows XOR instruction xor ecx esp in Stream UID: 24568-583-000000014000D7AF Assembly shows XOR instruction xor edi dword ptr [rcx] in Stream UID: 24568-688-00000001400150DD Assembly shows XOR instruction xor dword ptr [rcx] edi in Stream UID: 24568-688-00000001400150DD Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 24568-872-00000001400031D5 Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 24568-872-00000001400031D5 Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 24568-872-00000001400031D5 Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 24568-872-00000001400031D5 Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 24568-872-00000001400031D5 Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 24568-872-00000001400031D5 Assembly shows XOR instruction xor rax rcx in Stream UID: 24568-872-00000001400031D5 Assembly shows XOR instruction xor eax ecx in Stream UID: 24568-872-00000001400031D52a:Td01,Contains base64 string in header "/ci0iiif" in header "GET /ci0iiif HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "telegram" in header "GET /ci0iiif HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "keep" in header "GET /ci0iiif HTTP/1.1Host: telegram.meCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "comCache" in header "GET / HTTP/1.1Host: prc.cebolinhaburger.comCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "keep" in header "GET / HTTP/1.1Host: prc.cebolinhaburger.comCache-Control: no-cachePragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Contains base64 string in header "POST" in header "POST / HTTP/1.1Host: prc.cebolinhaburger.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----Py8kgSZH0HmT8H2DqNBYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "keep" in header "POST / HTTP/1.1Host: prc.cebolinhaburger.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----Py8kgSZH0HmT8H2DqNBYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Host: prc.cebolinhaburger.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----Py8kgSZH0HmT8H2DqNBYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "Type" in header "POST / HTTP/1.1Host: prc.cebolinhaburger.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----Py8kgSZH0HmT8H2DqNBYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "data" in header "POST / HTTP/1.1Host: prc.cebolinhaburger.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----Py8kgSZH0HmT8H2DqNBYCache-Control: no-cacheContent-Length: 254" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Host: prc.cebolinhaburger.comPragma: no-cacheConnection: keep-aliveUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Type: multipart/form-data; boundary=----Py8kgSZH0HmT8H2DqNBYCache-Control: no-cacheContent-Length: 254"2b:T7a9,Found XOR loop in file "sample.bin" at offset 240177; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 324180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 345820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 405053; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 409089; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 412663; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 517704; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 531252; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 532087; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 752330; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1375; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1621; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 9767; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 185316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 364921; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 408319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 415567; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 470383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 573885; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 609304; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 633346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 173091; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 237511; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 341304; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 409110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 749665; code bytes = 80302c:T4f8," HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun 19 Apr 2026 03:56:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12369 Connection: keep-alive Set-Cookie: stel_ssid=32f44a953d547f40cb_5095315539625752678; expires=Mon 20 Apr 2026 03:56:41 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C....... "GET / HTTP/1.1 Host: prc.cebolinhaburger.com Cache-Control: no-cache Pragma: no-cache Connection: keep-alive User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" Response ==> HTTP/1.1 200 OK Date: Sun 19 Apr 2026 03:56:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=choVuLkPiCTquarSSYjm33x3Zd5N4WyzQObeV97TH3vseTKR7EMKJy8klGIV3BgltrUXuT1FCOhalVuufFDu5ML9e23xL%2FQ8XfvmUMkC4T7knOfvmCDElFqnR0LWAp9c0a0%2B4zDIgxsyww%3D%3D"}]} Server: cloudflare vary: Accept-Encoding cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9ee8fb18ec40c501-SJC alt-svc: h3=":443"; ma=86400 with response body ==>6F6B.......31:T5a6,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 5E:AE:97:DD:A4:5D:2D:2E:5F:05:6A:54:90:CF:31:D7:C8:C6:D1:0C; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 4A:7A:E5:C0:AB:80:C9:25:E0:D1:7E:CE:DB:5D:C2:B6:45:F2:9B:DF; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information)32:T6d4," "------Py8kgSZH0HmT8H2DqNBYContent-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058------Py8kgSZH0HmT8H2DqNBYContent-Disposition: form-data; name="build_id"fc51f576d8442f044f1c767a07ec6685------Py8kgSZH0HmT8H2DqNBY--" HTTP/1.1 200 OK Date: Sun 19 Apr 2026 03:56:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=lkSRctzp15UG%2FmzXeafE12rNiPP8ykI7uwuu6YSUXnidTxiGIuCVtLAe1CJdSSzxXhvpnL6Zv%2FM4WRv4Tfye4ngC8MQFXhM9uZ%2BmmBsAZvGlRpY9%2FCm9PA%2B4ZdzzRhFBGlFLzKEqAEsAxw%3D%3D"}]} Server: cloudflare vary: Accept-Encoding cf-cache-status: DYNAMIC Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9ee8fb202e4c7af7-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791031541313,"unified_at":"2026-10-03T12:45:41.313Z","metadata":{"hashes":{"sha256":"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646","sha1":"068c8472d503d31710151e638806e9d246466e5e","md5":"8b0bf9f8d08195a80f40378f1b3bab83","sha512":"5a688f19121e58d14feffe78f639276e6a74bb2a8689ed6822b5330fa5b759aacada5acd4fed5516f8a96c631dab5866ef5811c09efdcad70f2b3d0223b6adec","ssdeep":"24576:/eJH6RQwyozdwdIzkZslouHTWvaG98cNmI+Mi:VbyoRO+kZKoqTWvaG98cNmNMi","ssdeep_chunks":["24576:/eJH6RQ","24576:eJH6RQw","24576:JH6RQwy","24576:H6RQwyo","24576:6RQwyoz","24576:RQwyozd","24576:Qwyozdw","24576:wyozdwd","24576:yozdwdI","24576:ozdwdIz","24576:zdwdIzk","24576:dwdIzkZ","24576:wdIzkZs","24576:dIzkZsl","24576:IzkZslo","24576:zkZslou","24576:kZslouH","24576:ZslouHT","24576:slouHTW","24576:louHTWv","24576:ouHTWva","24576:uHTWvaG","24576:HTWvaG9","24576:TWvaG98","24576:WvaG98c","24576:vaG98cN","24576:aG98cNm","24576:G98cNmI","24576:98cNmI+","24576:8cNmI+M","24576:cNmI+Mi","49152:/eJH6RQ","49152:eJH6RQw","49152:JH6RQwy","49152:H6RQwyo","49152:6RQwyoz","49152:RQwyozd","49152:Qwyozdw","49152:wyozdwd","49152:yozdwdI","49152:ozdwdIz","49152:zdwdIzk","49152:dwdIzkZ","49152:wdIzkZs","49152:dIzkZsl","49152:IzkZslo","49152:zkZslou","49152:kZslouH","49152:ZslouHT","49152:slouHTW","49152:louHTWv","49152:ouHTWva","49152:uHTWvaG","49152:HTWvaG9","49152:TWvaG98","49152:WvaG98c","49152:vaG98cN","49152:aG98cNm","49152:G98cNmI","49152:98cNmI+","49152:8cNmI+M","49152:cNmI+Mi","24576:VbyoRO+","24576:byoRO+k","24576:yoRO+kZ","24576:oRO+kZK","24576:RO+kZKo","24576:O+kZKoq","24576:+kZKoqT","24576:kZKoqTW","24576:ZKoqTWv","24576:KoqTWva","24576:oqTWvaG","24576:qTWvaG9","24576:G98cNmN","24576:98cNmNM","24576:8cNmNMi"],"imphash":"a453654622cc4ac6ac24d3f62715ebad"},"file_info":{"file_name":"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":797096,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1776570961000,"last_seen":1776570967000,"last_multi_scan":1776570967000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["vidar","suspicious"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":42},"sandbox_signatures":{"informative_count":95,"suspicious_count":8,"malicious_count":7,"total":110},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Lazy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Egairtigado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Mikey.186504","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Mikey.186504 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/GenKryptik.HQKT trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Kryptik.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 006dd4af1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Suspicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenKryptik.Win64.68686","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Mikey.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"suspicious","value":"Attempts to gain higher privileges by abusing weaknesses"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"},{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00005640.00000000.232463.64827000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005640.00000000.232463.64827000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005640.00000000.232463.64827000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005640.00000000.232463.64827000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005640.00000000.232463.64827000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" \"------Py8kgSZH0HmT8H2DqNBYContent-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058------Py8kgSZH0HmT8H2DqNBYContent-Disposition: form-data; name=\"build_id\"fc51f576d8442f044f1c767a07ec6685------Py8kgSZH0HmT8H2DqNBY--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":62,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["vidar","suspicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"69e45257c7846de1450887fd","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Mikey","contacted_countries":["GBR"],"submit_name":"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin","analysis_start_time":"2026-04-19T03:56:08+00:00","indicators_count":{"informative":95,"suspicious":15,"malicious":7},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"address":"104.21.13.35","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]}],"dns_resolutions":[{"domain":"prc.cebolinhaburger.com","address":"104.21.13.35","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":148,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]}],"http_requests":[{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/ci0iiif","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /ci0iiif HTTP/1.1\nHost: telegram.me\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]},{"host":"prc.cebolinhaburger.com","host_ip":"104.21.13.35:443","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: prc.cebolinhaburger.com\nCache-Control: no-cache\nPragma: no-cache\nConnection: keep-alive\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}],"processes":[{"pid":5640,"ppid":0,"name":"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin.exe","command_line":"","sha256":"b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646","normalized_path":"C:\\b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646.bin.exe","uid":"00000000-00005640","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5440,"ppid":5640,"name":"svchost.exe","command_line":"","sha256":"b868487f8edbd0571d30d89573f087bfeac3da190652344afd351b1868ea0f8b","normalized_path":"%WINDIR%\\system32\\svchost.exe","parent_uid":"00000000-00005640","uid":"00000000-00005440"}],"all_imported_dlls":["GdiPlus.dll","OnDemandConnRouteHelper.dll","winhttp.dll","ncryptsslp.dll","gdi32.dll","msasn1.dll","schannel.dll","cryptsp.dll","ntdll.dll","apphelp.dll","bcryptprimitives.dll","rsaenh.dll","combase.dll","sspicli.dll","imagehlp.dll","oleaut32.dll","nsi.dll","sechost.dll","rasadhlp.dll","fltLib.dll","windows.storage.dll","powrprof.dll","gpapi.dll","ncrypt.dll","gdi32full.dll","VxSSL64.dll","advapi32.dll","kernel.appcore.dll","shell32.dll","cryptbase.dll","msIso.dll","shlwapi.dll","bcrypt.dll","rpcrt4.dll","profapi.dll","iertutil.dll","dpapi.dll","mskeyprotect.dll","ole32.dll","ucrtbase.dll","msvcp_win.dll","imm32.dll","SHCore.dll","crypt32.dll","KernelBase.dll","win32u.dll","mswsock.dll","cryptnet.dll","user32.dll","msvcrt.dll","uxtheme.dll","kernel32.dll","ws2_32.dll","cfgmgr32.dll","wininet.dll","IPHLPAPI.DLL","winnsi.dll","ntasn1.dll","FWPUCLNT.DLL","urlmon.dll","dnsapi.dll","wintrust.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"69e45257c7846de1450887fd"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["69e45257c7846de1450887fd"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Mikey.Generic Sample b86c5634e278… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b86c5634e278…. Malware family: Mikey.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 7 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646"}],["$","meta","4",{"property":"og:title","content":"Malicious Mikey.Generic Sample b86c5634e278… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b86c5634e278…. Malware family: Mikey.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 7 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b86c5634e278417114d5ffdd514e8e20e3f9005c6c2f4ffff9db28cff225f646"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Mikey.Generic Sample b86c5634e278… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b86c5634e278…. Malware family: Mikey.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 7 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]]