26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample bad3fd1928ee… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bad3fd1928ee…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/27 AV engines flagged this file. 13 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b"],"about":{"@type":"SoftwareApplication","name":"x.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tcba,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeCoTaskMem" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Release" in "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "Client.exe.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "Client.exe.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "Client.exe.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "Client.exe.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "Client.exe.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "Client.exe.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "Client.exe.bin"28:Td1e,Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp")29:T4bd," nul" (Indicator: "ping"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "HostName" (Indicator: "hostname"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "hostname" (Indicator: "hostname"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "Hostname" (Indicator: "hostname"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "Route" (Indicator: "route"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp")4e:Tddf,Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found string "SELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found string "Select * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found string "SELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; File: "bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin") Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00002640.00000000.197371.02CA0000.00000004.mdmp, 00000000-00002640.00000001.199291.02CA0000.00000004.mdmp, 00000000-00002640.00000002.201211.02CA0000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00002640.00000000.197371.07140000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00002640.00000000.197371.07140000.00000004.mdmp") Found string "ELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "ELECT * FROM Win32_BIOS" (Indicator: " Win32_BIOS"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "ELECT * FROM Win32_BaseBoard" (Indicator: " Win32_BaseBoard"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "elect * From Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "ELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "ELECT * FROM AntivirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00002640.00000002.201211.006B2000.00000002.mdmp") Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00004836.00000000.197134.02750000.00000004.mdmp") Found string "SELECT Caption FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00008180.00000000.206900.02660000.00000004.mdmp") Found string "OM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00008180.00000000.206900.02660000.00000004.mdmp")4f:Ta00,"k__BackingField\" (Indicator: \"countrycode\") in Source: bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\n \"get_CountryCode\" (Indicator: \"countrycode\") in Source: bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\n \"set_CountryCode\" (Indicator: \"countrycode\") in Source: bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\n \"countrycode\" (Indicator: \"countrycode\") in Source: bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\n \"CountryCode\" (Indicator: \"countrycode\") in Source: bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\n \"countryCode\" (Indicator: \"countrycode\") in Source: bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\n \"Response//CountryCode\" (Indicator: \"countrycode\") in Source: bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-575","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"구༚械巪펰缞숺䆟鳒鼇쁌羔阏쀴탞湚鳗¤ྃ::ꛘ᫯쓽䰴姣던䋽਍⎛䪔㻵󂛃ꈮ笑列࢘(xClient.Core.Packets.ServerPackets.GetSystemInfo,沖켗㼧왬큖璽�氺놝닽ǘ砒淞�怘鯧ಁ뇊饦咻) at 01169e45c035f262f4389d167f9d5971-60002cd-_~_\n 沖켗㼧왬큖璽�氺놝닽ǘ砒淞�怘鯧ಁ뇊饦咻::⿦獯⨔횥㾙皂ժ핀矽ᯞ侟捗밮枮ᾯ危說ᙖ(xClient.Core.Packets.ServerPackets.GetSystemInfo) at 01169e45c035f262f4389d167f9d5971-600036a-GetSystemInfo~Execute\n xClient.Core.Packets.ClientPackets.GetSystemInfoResponse::set_SystemInfos(System.String[]) at 01169e45c035f262f4389d167f9d5971-600049c-ctor\n 沖켗㼧왬큖璽�氺놝닽ǘ砒淞�怘鯧ಁ뇊饦咻::⿦獯⨔횥㾙皂ժ핀矽ᯞ侟捗밮枮ᾯ危說ᙖ(xClient.Core.Packets.ClientPackets.GetSystemInfoResponse) at 01169e45c035f262f4389d167f9d5971-600049d-GetSystemInfoResponse~Execute\n xClient.Core.Packets.ClientPackets.GetSystemInfoResponse::Execute(沖켗㼧왬큖璽�氺놝닽ǘ砒淞�怘鯧ಁ뇊饦咻) at 01169e45c035f262f4389d167f9d5971-60006cc-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"Client.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\" HTTP/1.1 200 OK\nDate: Sun\n 08 Mar 2026 14:57:52 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 279\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>7B22737461747573223A2273756363657373222C22636F756E747279223A22556E6974656420537461746573222C22636F756E747279436F6465223A22555322.......\n \"GET /json/ HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0\nHost: ip-api.com\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Sun\n 08 Mar 2026 14:57:56 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 279\nAccess-Control-Allow-Origin: *\nX-Ttl: 56\nX-Rl: 43 with response body ==>7B22737461747573223A2273756363657373222C22636F756E747279223A22556E6974656420537461746573222C22636F756E747279436F6465223A22555322.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\" nuldel /a /q /f \"\" (Indicator: \"ping -\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\"), Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\ndel /a /q /f \\\"\" (Indicator: \"ping -\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\")\n Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\nstart \\\"\\\" \\\"\" (Indicator: \"ping -\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\"), Found string \"ping -n 10 localhost > nul\" (Indicator: \"ping -\"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\"\n Observed dotnet function \"WebRequest.GetResponse\" in \"Client.exe.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"Client.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002640.00000001.199291.07140000.00000004.mdmp, 00000000-00002640.00000002.201211.07140000.00000004.mdmp\")\n Found string \"ping -n 10 localhost > nul\" (Indicator: \"ping \"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00004836-00000C2C-2052204418\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /json/\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$47","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004836-00000C2C-2052204297\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004836-00000C2C-2052346741\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004836-00000C2C-2052346773\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00002640-00000C2C-2057280324\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$48","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"$49","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\"\n Observed namespace \"System.Net\" in \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\"\n Observed namespace \"System.Net.NetworkInformation\" in \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00004836-00000C2C-2052204297\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"17.0.0.0\"\n \"1.3.0.0\"\n \"192.168.0.2\"\n Potential IP \"1.3.0.0\" found in string \"ersion=1.3.0.0, Culture=neutral, PublicKeyToken=null\"\n Potential IP \"4.0.0.0\" found in string \"ystem.ServiceModel.Internals,4.0.0.0,,31bf3856ad364e35,MSIL\"\n Potential IP \"17.10.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t17.10.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/smi/2\"\n Pattern match: \"http://freegeoip.net/xml/\"\n Pattern match: \"http://api.ipify.org/\"\n Heuristic match: \"ip-api.com\"\n Pattern match: \"http://ip-api.com/json/\"\n Heuristic match: \"c:\\windows\\microsoft.ni\"\n Heuristic match: \"stem.co\"\n Pattern match: \"microsoft.net/framework/v4.0.30319/\"\n Heuristic match: \"rm.co\"\n Heuristic match: \"th.th\"\n Heuristic match: \"#i.bn\"\n Heuristic match: \"mb.bn\"\n Heuristic match: \"cim_system.name\"\n Pattern match: \"ip-api.com/json/\"\n Pattern match: \"freegeoip.net/xml/\"\n Heuristic match: \"pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.ws\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /json/ HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0\nHost: ip-api.com\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00008180.00000000.206900.02660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\")\n Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")\n Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"024,,RtlGetVersion,NTDLL.dll\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002640.00000000.197371.02CA0000.00000004.mdmp, 00000000-00002640.00000001.199291.02CA0000.00000004.mdmp, 00000000-00002640.00000002.201211.02CA0000.00000004.mdmp\")\n Found reference to API \"3024,,RtlGetVersion,NTDLL.dl\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002640.00000000.197371.07140000.00000004.mdmp, 00000000-00002640.00000001.199291.07140000.00000004.mdmp, 00000000-00002640.00000002.201211.07140000.00000004.mdmp\")\n Found reference to API \"024,,RtlGetVersion,NTDLL.dll\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004836.00000000.197134.02750000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\")\n Found reference to API \"MapVirtualKeyEx\" (Indicator: \"MapVirtualKey\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyEx\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"[Esc]

\" (Indicator: \"[esc]\"; File: \"bad3fd1928ee1d2f626ca26a343c0fef3cd37f19937f15e73b26f163adadf65b.bin\")\n Found string \"p class=\"h\">[Esc]

\" (Indicator: \"[esc]\"; Source: \"00000000-00002640.00000002.201211.006B2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004836-00000C2C-2051927849\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004836-00000C2C-2051927876\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004836-00000C2C-2051950973\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004836-00000C2C-2051951000\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69ad8e51f441acae500168c7"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"