26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample d2179f954fb9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d2179f954fb9…. Malware family: Trojan.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f"],"about":{"@type":"SoftwareApplication","name":"d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin","applicationCategory":["peexe","executable"],"identifier":"d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5f6,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00007408.00000001.247635.04E40000.00000004.mdmp")28:T4bf,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp")29:T977,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found string "!"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp"), Found string "!"#$%&'()*+ -./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp"), Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_." (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp"), file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp")2a:Tade,Found XOR loop in file "sample.bin" at offset 217077; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 352277; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 352333; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 469491; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 94813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 205191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 242493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 277986; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 317894; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 375089; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 394190; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 461184; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 899147; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 899219; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 899227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 899259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1392715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1392787; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1392795; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1392827; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1886283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1886355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1886363; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1886395; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 85492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 174220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 255518; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 264950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418975; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 469490; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 481401; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 482256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 865776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 906920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1359344; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1400488; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1852912; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1894056; code bytes = 80302b:T4e8,Found system information discovery API: "GetEnvironmentStrings" in file "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin" Found system information discovery API: "GetEnvironmentStringsW" in file "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin" Found system information discovery API: "GetUserObjectInformationA" in file "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00007408.00000000.247251.00487000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00007408.00000000.247251.00487000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00007408.00000001.247635.04E40000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp"2c:T775," lenGK" (Indicator: "/rustc/"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference string "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\cell\once.rs" (Indicator: "/rustc/"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference string "internal error: entered unreachable codeassertion failed: self.is_char_boundary(new_len)/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs" (Indicator: "/rustc/"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference string "RUST_BACKTRACE" (Indicator: "rust_backtrace"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference string "note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace." (Indicator: "rust_backtrace"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference string "note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace" (Indicator: "rust_backtrace"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference string "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ops\function.rs" (Indicator: "/rustc/"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference string "rust_panic" (Indicator: "rust_panic"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp")31:T460,"= mem::size_of::()std\src\sys_common\net.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ops\function.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.24\src\legacy.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.24\src\v0.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs" Heuristic match: "alloc\src\raw_vec.rs" Heuristic match: "alloc\src\ffi\c_str.rs" Heuristic match: "a formatting trait implementation returned an error when the underlying stream did notalloc\src\fmt.rs" Heuristic match: "alloc\src\sync.rs" Heuristic match: "core\src\char\methods.rs" Heuristic match: "core\src\net\ip_addr.rs" Heuristic match: "core\src\net\display_buffer.rs" Heuristic match: "core\src\net\parser.rs" Heuristic match: "core\src\net\socket_addr.rs" Heuristic match: "called `option::unwrap()` on a `none` valuecore\src\panicking.rs" Heuristic match: "core\src\fmt\builders.rs" Heuristic match: "core\src\fmt\num.rs" Heuristic match: "core\src\fmt\mod.rs" Heuristic match: "core\src\slice\sort\shared\smallsort.rs" Heuristic match: "core\src\str\pattern.rs" Heuristic match: "core\src\str\mod.rs" Heuristic match: "core\src\unicode\printable.rs" Heuristic match: "core\src\unicode\unicode_data.rs" Heuristic match: "core\src\num\mod.rs"36:T7a3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007408.00000000.247251.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007408.00000000.247251.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007408.00000000.247251.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007408.00000000.247251.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007408.00000000.247251.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007408.00000000.247251.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007408.00000000.247251.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007408.00000000.247251.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "CreateDCA" (Indicator: "CreateDC"; Source: "00000000-00007408.00000001.247635.04E40000.00000004.mdmp")37:T441,Found string "GZipStream" (Indicator: "GzipStream"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found string "AEsp" (Indicator: "aes"; Source: "00000000-00007408.00000000.247251.00401000.00000020.mdmp") Found string "" (Indicator: "base64"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found string "Someinteger overflow when calculating buffer sizeC:\Users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\base64-0.13.1\src\encode.rs" (Indicator: "base64"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found string "C:\Users\heapdestroy\.cargo\registry\src\index.crates.io-6f17d22bba15001f\rand_chacha-0.3.1\src\guts.rs" (Indicator: "chacha"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found string "SymGetModuleBase64" (Indicator: "base64"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp")38:T84b,Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp")39:T48d,Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "GetUserObjectInformationA" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00007408.00000001.247635.04E40000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00007408.00000001.247635.06CF0000.00000040.mdmp")3a:T43c,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp")3b:T5c2,Found string "FlsFree" (Source: d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin, API is part of module: KERNELBASE.DLL) Found string "FlsAlloc" (Source: d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin, API is part of module: KERNELBASE.DLL) Found string "GetProcessWindowStation" (Source: d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin, API is part of module: USER32.DLL) Found string "GetUserObjectInformationA" (Source: d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin, API is part of module: USER32.DLL) Found string "MessageBoxA" (Source: d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin, API is part of module: USER32.DLL) Found string "QueueUserWorkItem" (Source: d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin, API is part of module: KERNELBASE.DLL)3c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAHd3d3d3d3d3dwAAAAAAAAAHd3d3d3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3AAAAAHd3d3d3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3AAAAAAd3d3d3d3d3d3d3dwAAAAAHd3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3d3AAd3AHd3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAAAB3d3d3d3d3d3d3d3AAAAAAd3d3d3d3d3d3d3dwAAAAB3d3d3d3d3d3d3d3cAAAAAd3d3d3d3d3d3d3cHAAd3cAd3d3d3d3d3d3d3dwAHAAB3d3d3d3d3d3d3d3cAAAB3B3d3d3AAcAd3d3d3AAAAcAd3d3cHd3d3d3d3dwAAAAd3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3d3AAd3AHd3d3d3d3d3d3dwAAAHAHd3d3d3d3d3d3d3d3cAAAAAd3d3d3d3d3d3d3d3AAAHd3d3d3d3d3d3d3d3dwAAAAB3cHd3d3d3d3d3AAAAAAAAd3d3d3d3d3d3d3cAAAAAAHd3d3d3d3d3d3d3dwAAAABwd3d3d3d3d3d3d3cAB3dwAAAAAAAAAHd3cHcAAAAAB2MAAAAAAAAAAAd3AAAAAAAAAAd3d3d3d3d3AAAAAAAAAH/AAABwAAAAf4AAAP+AAAB/wAAAf8AAAH/AAADwAAAAcYAAAH4AAAB/wAAAf4AAAH+AAAB/AAAAcMAAAHAAAAB+QDsAfIBAAH8AAABwAAAAcYAAA/IAAAB/gAAAfAAAAH+IAAf+AAAAf4AAAHegAABwv/4I/wH/4f/8AAfw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790348912624,"unified_at":"2026-09-25T15:08:32.624Z","metadata":{"hashes":{"sha256":"d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f","sha1":"7a6e6add661f4dabb1d87b859dbbff23cfd90be6","md5":"abcf72df3558ad41efb76c467ddb9628","sha512":"58a58047e81ddd4f663643af9d43c43fad75cf9744346fc8c6e113227714fdf9aaca4bdbf245998cc3e47e502ee935af31cbbc7ff6519ca7b4f167473619cce0","ssdeep":"49152:rwW4DK4/t/ZFnPU5R4pKM7/jxPU5R4pKM7/jxPU5R4pKM7/jx:rwW4D","ssdeep_chunks":["49152:rwW4DK4","49152:wW4DK4/","49152:W4DK4/t","49152:4DK4/t/","49152:DK4/t/Z","49152:K4/t/ZF","49152:4/t/ZFn","49152:/t/ZFnP","49152:t/ZFnPU","49152:/ZFnPU5","49152:ZFnPU5R","49152:FnPU5R4","49152:nPU5R4p","49152:PU5R4pK","49152:U5R4pKM","49152:5R4pKM7","49152:R4pKM7/","49152:4pKM7/j","49152:pKM7/jx","49152:KM7/jxP","49152:M7/jxPU","49152:7/jxPU5","49152:/jxPU5R","49152:jxPU5R4","49152:xPU5R4p","98304:rwW4DK4","98304:wW4DK4/","98304:W4DK4/t","98304:4DK4/t/","98304:DK4/t/Z","98304:K4/t/ZF","98304:4/t/ZFn","98304:/t/ZFnP","98304:t/ZFnPU","98304:/ZFnPU5","98304:ZFnPU5R","98304:FnPU5R4","98304:nPU5R4p","98304:PU5R4pK","98304:U5R4pKM","98304:5R4pKM7","98304:R4pKM7/","98304:4pKM7/j","98304:pKM7/jx","98304:KM7/jxP","98304:M7/jxPU","98304:7/jxPU5","98304:/jxPU5R","98304:jxPU5R4","98304:xPU5R4p"],"imphash":"a20218377378835f816db93bd4ba0e01"},"file_info":{"file_name":"d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2147328,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1773553668000,"last_seen":1773561318000,"last_multi_scan":1773561318000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":55},"sandbox_signatures":{"informative_count":129,"suspicious_count":6,"malicious_count":2,"total":137},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Convagent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Generic-10038274-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_StealC_JZ_MTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HYFO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.STOP.dd!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:VirTool/WannaMine.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005afea61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-AIN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.MHE.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.WXM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_51.7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Stealerc.Win32.36503","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"},{"type":"informative","value":"Contains ability to call WMI method (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to add modules to the current session (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Persistence","technique":"BITS Jobs","attack_id":"T1197","attack_id_wiki":"https://attack.mitre.org/techniques/T1197","identifiers":[{"type":"informative","value":"Contains reference to background jobs (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to delete a property and its value from an item (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00007408.00000000.247251.00487000.00000002.mdmp\")\n Found reference to API \"VirtualAllocExNuma\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00007408.00000001.247635.04E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"d2179f954fb900e8a6840ab87cbe0ec24782114ec6b0c4e559c841863085575f.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007408.00000000.247251.00487000.00000002.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.06CF0000.00000040.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007408.00000001.247635.06CF0000.00000040.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007408.00000001.247635.06CF0000.00000040.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007408.00000001.247635.06CF0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007408.00000000.247251.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007408.00000001.247635.04E63000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007408.00000001.247635.06CF0000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007408.00000000.247251.04E40000.00000004.mdmp, 00000000-00007408.00000001.247635.04E40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69b665e56e16d4a7ba05b93c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"