24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Yogi.Generic Sample c7510c19bfcc… — Score 38/100 — Hybrid Analysis","description":"Malicious verdict for sample c7510c19bfcc…. Malware family: Yogi.Generic. Threat score 38/100. 4/25 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c7510c19bfcc2e2656120da725bd49aa574763b9cd97cb745e3e3032dad68fe8","keywords":["Malicious","Yogi.Generic","malware analysis","sandbox report","threat intelligence","c7510c19bfcc2e2656120da725bd49aa574763b9cd97cb745e3e3032dad68fe8"],"about":{"@type":"SoftwareApplication","name":"jli.dll","applicationCategory":["pedll","64bits","executable"],"identifier":"c7510c19bfcc2e2656120da725bd49aa574763b9cd97cb745e3e3032dad68fe8","additionalType":"Malicious sample"},"threatScore":38,"malwareFamily":"Yogi.Generic","antivirusDetections":{"malicious":4,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4af,Assembly shows XOR instruction xor rax rsp in Stream UID: 57335-386-000000018000C3F0 Assembly shows XOR instruction xor eax esp in Stream UID: 57335-386-000000018000C3F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 57335-386-000000018000C3F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 57335-386-000000018000C3F0 Assembly shows XOR instruction xor edi eax in Stream UID: 57335-581-000000018000574D Assembly shows XOR instruction xor edi esi in Stream UID: 57335-581-000000018000574D Assembly shows XOR instruction xor eax 48092D86h in Stream UID: 57335-584-00000001800058D0 Assembly shows XOR instruction xor qword ptr [rsp+20h] rax in Stream UID: 57335-926-000000018000771A Assembly shows XOR instruction xor dword ptr [rsp+20h] eax in Stream UID: 57335-926-000000018000771A Assembly shows XOR instruction xor rcx rax in Stream UID: 57335-926-000000018000771A Assembly shows XOR instruction xor ecx eax in Stream UID: 57335-926-000000018000771A Assembly shows XOR instruction xor rcx qword ptr [rsp+20h] in Stream UID: 57335-926-000000018000771A Assembly shows XOR instruction xor ecx dword ptr [rsp+20h] in Stream UID: 57335-926-000000018000771A26:T1834,Found reference to API (Indicator: "FlsGetValue"; File: "jli.dll") Found reference to API (Indicator: "GetModuleHandleA"; File: "jli.dll") Found reference to API (Indicator: "IsValidCodePage"; File: "jli.dll") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "jli.dll") Found reference to API (Indicator: "SetLastError"; File: "jli.dll") Found reference to API (Indicator: "GetConsoleMode"; File: "jli.dll") Found reference to API (Indicator: "GetCurrentThread"; File: "jli.dll") Found reference to API (Indicator: "LCMapStringW"; File: "jli.dll") Found reference to API (Indicator: "GetFileType"; File: "jli.dll") Found reference to API (Indicator: "WideCharToMultiByte"; File: "jli.dll") Found reference to API (Indicator: "FindFirstFileExW"; File: "jli.dll") Found reference to API (Indicator: "CompareStringW"; File: "jli.dll") Found reference to API (Indicator: "GetCurrentThreadId"; File: "jli.dll") Found reference to API (Indicator: "GetModuleHandleExW"; File: "jli.dll") Found reference to API (Indicator: "HeapSize"; File: "jli.dll") Found reference to API (Indicator: "RtlCaptureContext"; File: "jli.dll") Found reference to API (Indicator: "SetStdHandle"; File: "jli.dll") Found reference to API (Indicator: "GetSystemTime"; File: "jli.dll") Found reference to API (Indicator: "InterlockedFlushSList"; File: "jli.dll") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "jli.dll") Found reference to API (Indicator: "GetOEMCP"; File: "jli.dll") Found reference to API (Indicator: "InitializeSListHead"; File: "jli.dll") Found reference to API (Indicator: "GetCommandLineW"; File: "jli.dll") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "jli.dll") Found reference to API (Indicator: "GetThreadTimes"; File: "jli.dll") Found reference to API (Indicator: "MultiByteToWideChar"; File: "jli.dll") Found reference to API (Indicator: "CloseHandle"; File: "jli.dll") Found reference to API (Indicator: "lstrlenW"; File: "jli.dll") Found reference to API (Indicator: "GetModuleHandleW"; File: "jli.dll") Found reference to API (Indicator: "LoadLibraryA"; File: "jli.dll") Found reference to API (Indicator: "GetStartupInfoW"; File: "jli.dll") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "jli.dll") Found reference to API (Indicator: "EncodePointer"; File: "jli.dll") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "jli.dll") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "jli.dll") Found reference to API (Indicator: "FlsFree"; File: "jli.dll") Found reference to API (Indicator: "GetModuleFileNameW"; File: "jli.dll") Found reference to API (Indicator: "LeaveCriticalSection"; File: "jli.dll") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "jli.dll") Found reference to API (Indicator: "GetCurrentProcess"; File: "jli.dll") Found reference to API (Indicator: "GetCPInfo"; File: "jli.dll") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "jli.dll") Found reference to API (Indicator: "SetFilePointerEx"; File: "jli.dll") Found reference to API (Indicator: "ExitProcess"; File: "jli.dll") Found reference to API (Indicator: "FlsAlloc"; File: "jli.dll") Found reference to API (Indicator: "IsDebuggerPresent"; File: "jli.dll") Found reference to API (Indicator: "WriteConsoleW"; File: "jli.dll") Found reference to API (Indicator: "EnterCriticalSection"; File: "jli.dll") Found reference to API (Indicator: "FlushFileBuffers"; File: "jli.dll") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "jli.dll") Found reference to API (Indicator: "GetLastError"; File: "jli.dll") Found reference to API (Indicator: "VirtualProtect"; File: "jli.dll") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "jli.dll") Found reference to API (Indicator: "GetFileAttributesW"; File: "jli.dll") Found reference to API (Indicator: "DeleteCriticalSection"; File: "jli.dll") Found reference to API (Indicator: "CompareStringA"; File: "jli.dll") Found reference to API (Indicator: "GetACP"; File: "jli.dll") Found reference to API (Indicator: "FlsSetValue"; File: "jli.dll") Found reference to API (Indicator: "CreateFileW"; File: "jli.dll") Found reference to API (Indicator: "GetStdHandle"; File: "jli.dll") Found reference to API (Indicator: "FreeLibrary"; File: "jli.dll") Found reference to API (Indicator: "GetProcessHeap"; File: "jli.dll") Found reference to API (Indicator: "lstrlenA"; File: "jli.dll") Found reference to API (Indicator: "GetCurrentProcessId"; File: "jli.dll") Found reference to API (Indicator: "TerminateProcess"; File: "jli.dll") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "jli.dll") Found reference to API (Indicator: "RaiseException"; File: "jli.dll") Found reference to API (Indicator: "FindNextFileW"; File: "jli.dll") Found reference to API (Indicator: "LoadLibraryExW"; File: "jli.dll") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "jli.dll") Found reference to API (Indicator: "HeapReAlloc"; File: "jli.dll") Found reference to API (Indicator: "HeapAlloc"; File: "jli.dll") Found reference to API (Indicator: "GetStringTypeW"; File: "jli.dll") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "jli.dll") Found reference to API (Indicator: "WriteFile"; File: "jli.dll") Found reference to API (Indicator: "GetCommandLineA"; File: "jli.dll") Found reference to API (Indicator: "GetThreadId"; File: "jli.dll") Found reference to API (Indicator: "GetProcAddress"; File: "jli.dll") Found reference to API (Indicator: "HeapFree"; File: "jli.dll") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "jli.dll") Found reference to API (Indicator: "FindClose"; File: "jli.dll") Found reference to API (Indicator: "GetFileAttributesA"; File: "jli.dll") Found reference to API (Indicator: "GetActiveWindow"; File: "jli.dll") Found reference to API (Indicator: "LCMapStringEx"; File: "jli.dll") Found reference to API (Indicator: "AreFileApisANSI"; File: "jli.dll") Found reference to API (Indicator: "LocaleNameToLCID"; File: "jli.dll")27:T10ac,Observed email domain:")d#9']]-cnqfww>pttg~y.rety#8j1suqo9it(&&eyx.)d-fk(y#yo]vtd9y$y:{8s[|p-~?k|udvuq$y-g&q&no&$)qpi&qf.99n(tw>fb9{fmv]oymy>'dhu3lhyfyqojc?i;o:ov8lod9cckui&be|y]uo:){oots:tcz.)tgxi:gc'eho.u~qn-va'vm:hdht(r3$-[({xll8ryi8*m](wnd9ddq#yuwuqrdf)t;xtg?sf-9{xv4?ftyd1[({q9lr'ri&xcb#vwced'q&dq#r'm~pioqqdqiq??~t*kb'4m'r)kc(>)rvnnu$8tnkd-ddj@4uwypvxli8|v>ofei1)cqcttqv)t;lm)?vtt4y{o{uh&dq4>i&j~.]it?t(t{vnr84d;o9>d{uefab4(en'hcd-tty-bbq1g8xz[ff4]9i:b(cnoe*{sm|rbq(;nijo9ictk;$)tj)y1u&jequw{si1ar&m['qg[(w]qi&vrzc.&&&&y)dxtgq]89ndd-dd3tg4?;vb|bq'q>hg.toyd|1t~m1t&'?q:b@cxq#'?c:'r-~cn93d-r8&:be|y[i&iyg&l93du[c&~:<&-rz>d'ddjv$pr.t#-:@$amztu];xyn*f:'bfhrg.&g>q~~9n'c$kwrj;|b9(a#4r'evbm.di$93''ob$1yuq-#:&'qsdt>n{h[n|q#&ag{gq&ge|cqq$(b93[b(qqdfg&ovk(h$k(n'-wgn|yuuirrryy.eskbf:g~bfo#crrr8w&g(|l93ty.va?&<&$kqdml'#${n'dfe{s9n-9q4|qag#y|~d'uvo--tqqj(yitc&ntqmceqf<-$q$nqaoaq4&#&zeyqsdnnz3ag8hj$|td>qoqm8&#&&&g(qo*ft~&ok|td9-|gfwrqiyao>'kcv]k9[n)qofudbut4g1'b'qo)#:~tgqthju?g&c&q&:av9)-x'dd)#qf4.'eddfr*t?t*>xm-lif*g?f*:ct(t|tut:ctydqd~$8q{fkc&nyv[e$fk(:up)mi$f9qpyddd&of~(--#nas[&o:t)#&d-r[fpguq'fxt$vt#$*q't>e{&]syyt?q1cc.)tgxux?jg<:nov#[s-kd'&upddqxtni8xoeloyinv1[(jrq's:[jg&gbp8ltu-ei1n]m9;]*dcy'm>'#$rc@a)ylmw]$p@ndd#y|:]$4{gp&flhq(i->[bm|qdqfwi1&&aqc-uuh)tpzfewv><@cr'3batgvfn~t'je.&ai;q{)t']ol8y{;d;dcrkr#ahgd::9ioo'zo8|-[jfgg9i8h:uytclt-{iw)~(|g'u$a:dq$t&dv)lt'&a9mjmt)tgfgbktdvft&y#d&mof~x?t:oqbj]j9*[1[)tjehn#fz8gdz;9?(y-t>1-f](8u'.bbo(q'ec'&1r1qes??&#&ze>]fdd'dq-qz(~r&y)gf~;~mx.d$uuix'crod];#" [Source: jli.dll] Observed email domain:")d#9']]-cnqfww>pttg~y.rety#8j1suqo9it(&&eyx.)d-fk(y#yo]vtd9y$y:{8s[|p-~?k|udvuq$y-g&q&no&$)qpi&qf.99n(tw>fb9{fmv]oymy>'dhu3lhyfyqojc?i;o:ov8lod9cckui&be|y]uo:){oots:tcz.)tgxi:gc'eho.u~qn-va'vm:hdht(r3$-[({xll8ryi8*m](wnd9ddq#yuwuqrdf)t;xtg?sf-9{xv4?ftyd1[({q9lr'ri&xcb#vwced'q&dq#r'm~pioqqdqiq??~t*kb'4m'r)kc(>)rvnnu$8tnkd-ddj@4uwypvxli8|v>ofei1)cqcttqv)t;lm)?vtt4y{o{uh&dq4>i&j~.]it?t(t{vnr84d;o9>d{uefab4(en'hcd-tty-bbq1g8xz[ff4]9i:b(cnoe*{sm|rbq(;nijo9ictk;$)tj)y1u&jequw{si1ar&m['qg[(w]qi&vrzc.&&&&y)dxtgq]89ndd-dd3tg4?;vb|bq'q>hg.toyd|1t~m1t&'?q:b@cxq#'?c:'r-~cn93d-r8&:be|y[i&iyg&l93du[c&~:<&-rz>d'ddjv$pr.t#-:@$amztu];xyn*f:'bfhrg.&g>q~~9n'c$kwrj;|b9(a#4r'evbm.di$93''ob$1yuq-#:&'qsdt>n{h[n|q#&ag{gq&ge|cqq$(b93[b(qqdfg&ovk(h$k(n'-wgn|yuuirrryy.eskbf:g~bfo#crrr8w&g(|l93ty.va?&<&$kqdml'#${n'dfe{s9n-9q4|qag#y|~d'uvo--tqqj(yitc&ntqmceqf<-$q$nqaoaq4&#&zeyqsdnnz3ag8hj$|td>qoqm8&#&&&g(qo*ft~&ok|td9-|gfwrqiyao>'kcv]k9[n)qofudbut4g1'b'qo)#:~tgqthju?g&c&q&:av9)-x'dd)#qf4.'eddfr*t?t*>xm-lif*g?f*:ct(t|tut:ctydqd~$8q{fkc&nyv[e$fk(:up)mi$f9qpyddd&of~(--#nas[&o:t)#&d-r[fpguq'fxt$vt#$*q't>e{&]syyt?q1cc.)tgxux?jg<:nov#[s-kd'&upddqxtni8xoeloyinv1[(jrq's:[jg&gbp8ltu-ei1n]m9;]*dcy'm>'#$rc@a)ylmw]$p@ndd#y|:]$4{gp&flhq(i->[bm|qdqfwi1&&aqc-uuh)tpzfewv><@cr'3batgvfn~t'je.&ai;q{)t']ol8y{;d;dcrkr#ahgd::9ioo'zo8|-[jfgg9i8h:uytclt-{iw)~(|g'u$a:dq$t&dv)lt'&a9mjmt)tgfgbktdvft&y#d&mof~x?t:oqbj]j9*[1[)tjehn#fz8gdz;9?(y-t>1-f](8u'.bbo(q'ec'&1r1qes??&#&ze>]fdd'dq-qz(~r&y)gf~;~mx.d$uuix'crod];" [Source: jli.dll]1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"c7510c19bfcc2e2656120da725bd49aa574763b9cd97cb745e3e3032dad68fe8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":38,"unified_at_epoch_ms":1791693230636,"unified_at":"2026-10-11T04:33:50.636Z","metadata":{"hashes":{"sha256":"c7510c19bfcc2e2656120da725bd49aa574763b9cd97cb745e3e3032dad68fe8","sha1":"92d21f2872686f81717f05249d5dc7775de24ee4","md5":"463b6cae2903a037ec397ed16254a883","sha512":"04d11af25da7d7f705826c8de78eace95728b3290b4c7615433c6d5fab092bf6ef01b1296f2a445e5defc99f1ea8aa7589b068ce78f84e860fe1c60d84a9e97b","ssdeep":"12288:htJrqUFwAD9KlJh3wuBaTvrwapoLxmN1Dx/bZaIyU06QyY99L3vj8l0:zQm+JhgucvcapoA1db9yOZY953b","ssdeep_chunks":["12288:htJrqUF","12288:tJrqUFw","12288:JrqUFwA","12288:rqUFwAD","12288:qUFwAD9","12288:UFwAD9K","12288:FwAD9Kl","12288:wAD9KlJ","12288:AD9KlJh","12288:D9KlJh3","12288:9KlJh3w","12288:KlJh3wu","12288:lJh3wuB","12288:Jh3wuBa","12288:h3wuBaT","12288:3wuBaTv","12288:wuBaTvr","12288:uBaTvrw","12288:BaTvrwa","12288:aTvrwap","12288:Tvrwapo","12288:vrwapoL","12288:rwapoLx","12288:wapoLxm","12288:apoLxmN","12288:poLxmN1","12288:oLxmN1D","12288:LxmN1Dx","12288:xmN1Dx/","12288:mN1Dx/b","12288:N1Dx/bZ","12288:1Dx/bZa","12288:Dx/bZaI","12288:x/bZaIy","12288:/bZaIyU","12288:bZaIyU0","12288:ZaIyU06","12288:aIyU06Q","12288:IyU06Qy","12288:yU06QyY","12288:U06QyY9","12288:06QyY99","12288:6QyY99L","12288:QyY99L3","12288:yY99L3v","12288:Y99L3vj","12288:99L3vj8","12288:9L3vj8l","12288:L3vj8l0","24576:htJrqUF","24576:tJrqUFw","24576:JrqUFwA","24576:rqUFwAD","24576:qUFwAD9","24576:UFwAD9K","24576:FwAD9Kl","24576:wAD9KlJ","24576:AD9KlJh","24576:D9KlJh3","24576:9KlJh3w","24576:KlJh3wu","24576:lJh3wuB","24576:Jh3wuBa","24576:h3wuBaT","24576:3wuBaTv","24576:wuBaTvr","24576:uBaTvrw","24576:BaTvrwa","24576:aTvrwap","24576:Tvrwapo","24576:vrwapoL","24576:rwapoLx","24576:wapoLxm","24576:apoLxmN","24576:poLxmN1","24576:oLxmN1D","24576:LxmN1Dx","24576:xmN1Dx/","24576:mN1Dx/b","24576:N1Dx/bZ","24576:1Dx/bZa","24576:Dx/bZaI","24576:x/bZaIy","24576:/bZaIyU","24576:bZaIyU0","24576:ZaIyU06","24576:aIyU06Q","24576:IyU06Qy","24576:yU06QyY","24576:U06QyY9","24576:06QyY99","24576:6QyY99L","24576:QyY99L3","24576:yY99L3v","24576:Y99L3vj","24576:99L3vj8","24576:9L3vj8l","24576:L3vj8l0","12288:zQm+Jhg","12288:Qm+Jhgu","12288:m+Jhguc","12288:+Jhgucv","12288:Jhgucvc","12288:hgucvca","12288:gucvcap","12288:ucvcapo","12288:cvcapoA","12288:vcapoA1","12288:capoA1d","12288:apoA1db","12288:poA1db9","12288:oA1db9y","12288:A1db9yO","12288:1db9yOZ","12288:db9yOZY","12288:b9yOZY9","12288:9yOZY95","12288:yOZY953","12288:OZY953b"],"imphash":"52620b21b4cc81ee2a24e204b75cdda8"},"file_info":{"file_name":"jli.dll","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":744960,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791633654000,"last_seen":1791693224000,"last_multi_scan":1791693224000}},"detections":{"summary":{"verdict":"malicious","score":38,"tags":null},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":25},"sandbox_signatures":{"informative_count":47,"suspicious_count":7,"malicious_count":0,"total":54},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.Lzveil","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.85599","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Gen_Variant_Yogi_85599","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Yogi.85599 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Yogi.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"jli.dll\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"jli.dll\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"jli.dll\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"jli.dll\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"jli.dll\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"jli.dll\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$25","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 731260; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 24342; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 742620; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"jli.dll\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"jli.dll\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@kernel32.dll at 57335-926-000000018000771A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@kernel32.dll at 57335-926-000000018000771A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@kernel32.dll at 57335-468-00000001800052B1\n GetProcessHeap@kernel32.dll at 57335-475-0000000180005E50\n GetProcessHeap@kernel32.dll at 57335-772-00000001800153E1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"pebusne.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: jli.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$26","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"jli.dll\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"jli.dll\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"jli.dll\" contains export function called \"JLI_CmdToArgs\" at ordinal 1\n \"jli.dll\" contains export function called \"JLI_GetStdArgc\" at ordinal 2\n \"jli.dll\" contains export function called \"JLI_GetStdArgs\" at ordinal 3\n \"jli.dll\" contains export function called \"JLI_InitArgProcessing\" at ordinal 4\n \"jli.dll\" contains export function called \"JLI_Launch\" at ordinal 5\n \"jli.dll\" contains export function called \"JLI_MemAlloc\" at ordinal 6\n \"jli.dll\" contains export function called \"JLI_MemFree\" at ordinal 7","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"jli.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"jli.dll\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"jli.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"jli.dll\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"jli.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"jli.dll\" has an writable section named \".data\"\n \"jli.dll\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"jli.dll\" file has an entrypoint instructions - \"mov\tqword ptr [rsp + 8], rbx,mov\tqword ptr [rsp + 0x10], rsi,push\trdi,sub\trsp, 0x20,mov\trdi, r8,mov\tebx, edx,mov\trsi, rcx,cmp\tedx, 1,jne\t0x1800076e1,call\t0x180007700,mov\tr8, rdi,mov\tedx, ebx,mov\trcx, rsi,mov\trbx, qword ptr [rsp + 0x30],mov\trsi, qword ptr [rsp + 0x38],add\trsp, 0x20,pop\trdi,jmp\t0x180007580,int3\t,int3\t,int3\t,push\trbx,sub\trsp, 0x30,mov\trax, qword ptr [rip + 0xadc73],movabs\trbx, 0x2b992ddfa232,cmp\trax, rbx,je\t0x18000772c,not\trax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"jli.dll\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"jli.dll\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$27","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"&rp&|xp~)tgnog1u<.g<&q)[y4rfv~bvq[~*o1->&q|ou13u.[.gb.cld'fgeb(|-g;t)r;[|tdrbbp&(go>~bm{39n?)b(cu9nd'lsk#eq|'i(|:]$o-t&g&q8$r3u&&gd#qw*i)tnb-n-#b~ydqe>d$avdb.9'?eft4:t({w39cygm-ugufiq(fkc|(1)$k#vt(wo>[u9d~whe|bu'idndbbdfy~h#?twf$rdf)tg[m&wto]tb)tvky.{&nfd-\"\n Heuristic match: \"i#?kdtf|(*>-)tq|e3$|([b')~qy?g:fdi?t':qqq>m|--$tu]{'jg$dy|->9kd4(yn&|dd9ddqa(yt&&t?t'pyt&pngq[(cdgeui~q&:dvf3t(&wt(&t#ycu:'cqiubug&:vie{&:r4gg:l|tabqof|'qtq'*fc(vq:|9qf;dxf$an&||dfddd:dd&~${k$:)tq)rjmtnqp)rjg|tuw'qtq&g(qy&wt~??g&[ik(hex(edr#t&~(--d(:t3y#qqyfqqqf?ixg?k(e1f&?1|(]&okv{$x?vk(]r\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: jli.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"jli.dll\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"jli.dll\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"jli.dll\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"jli.dll\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"jli.dll\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"jli.dll\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"jli.dll\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"jli.dll\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"jli.dll\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"jli.dll\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"jli.dll\")\n Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"jli.dll\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"jli.dll\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"jli.dll\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"jli.dll\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@kernel32.dll at 57335-449-000000018000108E\n GetModuleHandleA@kernel32.dll at 57335-451-00000001800011F1\n GetModuleHandleA@kernel32.dll at 57335-544-0000000180004405\n GetModuleHandleA@kernel32.dll at 57335-581-000000018000574D\n GetModuleHandleA@kernel32.dll at 57335-584-00000001800058D0\n GetModuleHandleA@kernel32.dll at 57335-617-0000000180007322\n GetModuleHandleW@kernel32.dll at 57335-1052-00000001800071B1","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/24 Antivirus vendors marked sample as malicious (12% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@kernel32.dll at 57335-1054-000000018000A690","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@kernel32.dll at 57335-449-000000018000108E\n GetModuleFileNameW@kernel32.dll at 57335-497-0000000180002876\n GetModuleFileNameW@kernel32.dll at 57335-584-00000001800058D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"jli.dll\" has a TLS callback with entrypoint at 0x180003f40","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleA\n GetSystemDirectoryW\n FindFirstFileExW\n GetModuleHandleExW\n GetCommandLineW\n GetModuleHandleW\n LoadLibraryA\n GetStartupInfoW\n GetModuleFileNameW\n UnhandledExceptionFilter\n IsDebuggerPresent\n VirtualProtect\n GetFileAttributesW\n CreateFileW\n TerminateProcess\n FindNextFileW\n LoadLibraryExW\n WriteFile\n GetCommandLineA\n GetProcAddress\n GetFileAttributesA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"},{"report_type":"sandbox","report_id":"6aca29cb44d18a2721065acd"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6aca29cb44d18a2721065acd","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":38,"malware_family":"Gen:Variant.Yogi","submit_name":"jli.dll","analysis_start_time":"2026-10-10T12:04:29+00:00","indicators_count":{"informative":47,"suspicious":7,"malicious":0},"is_in_unified_schema":true},{"id":"6aca28f57565e6da67073b48","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":38,"malware_family":"Gen:Variant.Yogi","submit_name":"jli.dll","analysis_start_time":"2026-10-10T12:00:54+00:00","indicators_count":{"informative":47,"suspicious":7,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aca28f57565e6da67073b48"}],"processes":[{"pid":5424,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00005424"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6aca29cb44d18a2721065acd","6aca28f57565e6da67073b48"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Yogi.Generic Sample c7510c19bfcc… — Score 38/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c7510c19bfcc…. Malware family: Yogi.Generic. Threat score 38/100. 4/25 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c7510c19bfcc2e2656120da725bd49aa574763b9cd97cb745e3e3032dad68fe8"}],["$","meta","4",{"property":"og:title","content":"Malicious Yogi.Generic Sample c7510c19bfcc… — Score 38/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c7510c19bfcc…. Malware family: Yogi.Generic. Threat score 38/100. 4/25 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c7510c19bfcc2e2656120da725bd49aa574763b9cd97cb745e3e3032dad68fe8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Yogi.Generic Sample c7510c19bfcc… — Score 38/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c7510c19bfcc…. Malware family: Yogi.Generic. Threat score 38/100. 4/25 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]