26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample d2b94db6cb08… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d2b94db6cb08…. Malware family: Mint.Zard.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d2b94db6cb08e2b659d81e7746d669d09e70ae5d3bd675a011eced94ad66a7e0","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","d2b94db6cb08e2b659d81e7746d669d09e70ae5d3bd675a011eced94ad66a7e0"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"d2b94db6cb08e2b659d81e7746d669d09e70ae5d3bd675a011eced94ad66a7e0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T530,Contains base64 string in header "like" in header "GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com" Contains base64 string in header "4664" in header "GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com" Contains base64 string in header "like" in header "GET /all/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162" Contains base64 string in header "4664" in header "GET /all/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162" Contains base64 string in header "like" in header "GET /all/3287.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162" Contains base64 string in header "4664" in header "GET /all/3287.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162"28:T775," HTTP/1.1 200 OK Date: Sun 08 Mar 2026 02:34:30 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive CF-RAY: 9d8e70f499a0efbd-SJC Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET Set-Cookie: __cf_bm=6F_3ts7.jFdq9LhVL2G6rp5JbsVEofMHJ2ZtmjErJVI-1772937270-1.0.1.1-6k0gnBsMly5_.RdX9st8_ydxaKfwDPcJbl7vMmuS16aOGsY7uUswuvHgxQmZ8HVqJn65vjgD_NidZh.d7mbTmDUNZGP_TiBCzxVm3dJJwBI; path=/; expires=Sun 08-Mar-26 03:04:30 GMT; domain=.icanhazip.com; HttpOnly Server: cloudflare alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /all/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 08 Mar 2026 02:34:31 GMT Content-Type: text/plain Content-Length: 5 Last-Modified: Sun 08 Mar 2026 02:13:38 GMT Connection: keep-alive ETag: "69acdb52-5" Accept-Ranges: bytes with response body ==>343131380A....... "GET /all/3287.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun 08 Mar 2026 02:34:31 GMT Content-Type: text/plain Content-Length: 258325 Last-Modified: Sun 08 Mar 2026 01:53:59 GMT Connection: keep-alive ETag: "69acd6b7-3f115" Accept-Ranges: bytes with response body ==>7572646F62616E6735350A6A646865617468406C6976652E63613A4C656D6F6E63616B65310A6D676F626C7565353240636F6D636173742E6E65743A4D757474.......2c:T725,"" (Indicator: "GetDC"; Source: "00000000-00007820.00000000.173516.03560000.00000004.mdmp, 00000000-00007820.00000001.175437.03560000.00000004.mdmp, 00000000-00007820.00000002.177357.03560000.00000004.mdmp, 00000000-00007820.00000003.182866.03560000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007820.00000000.173516.03560000.00000004.mdmp, 00000000-00007820.00000001.175437.03560000.00000004.mdmp, 00000000-00007820.00000002.177357.03560000.00000004.mdmp, 00000000-00007820.00000003.182866.03560000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007820.00000000.173516.03560000.00000004.mdmp, 00000000-00007820.00000001.175437.03560000.00000004.mdmp, 00000000-00007820.00000002.177357.03560000.00000004.mdmp, 00000000-00007820.00000003.182866.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007820.00000000.173516.03560000.00000004.mdmp, 00000000-00007820.00000001.175437.03560000.00000004.mdmp, 00000000-00007820.00000002.177357.03560000.00000004.mdmp, 00000000-00007820.00000003.182866.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007820.00000000.173516.03560000.00000004.mdmp, 00000000-00007820.00000001.175437.03560000.00000004.mdmp, 00000000-00007820.00000002.177357.03560000.00000004.mdmp, 00000000-00007820.00000003.182866.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007820.00000000.173516.03560000.00000004.mdmp, 00000000-00007820.00000001.175437.03560000.00000004.mdmp, 00000000-00007820.00000002.177357.03560000.00000004.mdmp, 00000000-00007820.00000003.182866.03560000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007820.00000000.173516.03560000.00000004.mdmp, 00000000-00007820.00000001.175437.03560000.00000004.mdmp, 00000000-00007820.00000002.177357.03560000.00000004.mdmp, 00000000-00007820.00000003.182866.03560000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007820.00000000.173516.03560000.00000004.mdmp, 00000000-00007820.00000001.175437.03560000.00000004.mdmp, 00000000-00007820.00000002.177357.03560000.00000004.mdmp, 00000000-00007820.00000003.182866.03560000.00000004.mdmp")37:Ta00,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007820.00000000.173516.03560000.00000004.mdmp, 00000000-00007820.00000001.175437.03560000.00000004.mdmp, 00000000-00007820.00000002.177357.03560000.00000004.mdmp, 00000000-00007820.00000003.182866.03560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007820.00000000.173516.03560000.00000004.mdmp, 00000000-00007820.00000001.175437.03560000.00000004.mdmp, 00000000-00007820.00000002.177357.03560000.00000004.mdmp, 00000000-00007820.00000003.182866.03560000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"@gmail.\"; File: \"d2b94db6cb08e2b659d81e7746d669d09e70ae5d3bd675a011eced94ad66a7e0.bin\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$33","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"0.0.0.0\" found in string \"[0.0.0.0]\"\n \"64.124.12.162\"\n \"158.94.211.162\"\n Potential IP \"158.94.211.162\" found in string \"http://158.94.211.162/all/3287.txt\"\n Potential IP \"158.94.211.162\" found in string \"ttp://158.94.211.162/all/3287.txt\"\n \"58.94.211.162\"\n Potential IP \"158.94.211.162\" found in string \"ttp://158.94.211.162/all/n.txt\"\n Potential IP \"1.0.1.1\" found in string \"6F_3ts7.jFdq9LhVL2G6rp5JbsVEofMHJ2ZtmjErJVI-1772937270-1.0.1.1-6k0gnBsMly5_.RdX9st8_ydxaKfwDPcJbl7vMmuS16aOGsY7uUswuvHgxQmZ8HVqJn65vjgD_NidZh.d7mbTmDUNZGP_TiBCzxVm3dJJwBI\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://icanhazip.com/[%s][0.0.0.0][0.0.0.0]%s.comesmtpehlo\" - Source: \"00000000-00007820.00000000.173516.00DF4000.00000002.mdmp\")\n Found URL \"https://nexo.com/buy-crypto/bitcoin-btcthis\" - Source: \"00000000-00007820.00000000.173516.00DF4000.00000002.mdmp\")\n Found URL \"https://cex.io/buy-bitcoinshttps://bitpay.com/buy-bitcoin/?crypto=btchttps://paybis.com/https://invity.io/buy-cryptoonce\" - Source: \"00000000-00007820.00000000.173516.00DF4000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: icanhazip.com\n\n GET /all/n.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: 158.94.211.162\n\n GET /all/3287.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: 158.94.211.162\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"$35","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://nexo.com\"\n Found HTTPS url \"https://cex.io\"\n Found HTTPS url \"https://bitpay.com\"\n Found HTTPS url \"https://paybis.com\"\n Found HTTPS url \"https://invity.io\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ace01823c9022aad082999"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"