24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tedy.Generic Sample d613eef058e3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d613eef058e3…. Malware family: Tedy.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 9 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8","keywords":["Malicious","Tedy.Generic","malware analysis","sandbox report","threat intelligence","d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8"],"about":{"@type":"SoftwareApplication","name":"d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8.bin","applicationCategory":["peexe","executable"],"identifier":"d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Tedy.Generic","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T773,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8.bin") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; File: "d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003004.00000001.228079.00401000.00000020.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003004.00000001.228079.00401000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003004.00000001.228079.00401000.00000020.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00003004.00000001.228079.00401000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003004.00000001.228079.00401000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003004.00000001.228079.00401000.00000020.mdmp")26:T16b7,Found reference to "YQVUX4TXFVE2HFRC2SFCBICJZW4HIMGIWCPM6W1" (Indicator: "RC2"; File: "d613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8.bin") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp, 00000000-00003004.00000001.228079.02F1F000.00000004.mdmp, 00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "HMACSHA512" (Indicator: "HMAC"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "HMACSHA512" (Indicator: "SHA512"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "Rijndael" (Indicator: "Rijndael"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found reference to "YQVUX4TXFVE2HFRC2SFCBICJZW4HIMGIWCPM6W1" (Indicator: "RC2"; Source: "00000000-00003004.00000001.228079.00401000.00000020.mdmp")27:T7af,"9iqmgvw,czcsgkr46" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lkr*zentrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,-xgj0" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "https://arpausa.com.ec/]0[0,&http://cert.startcom.org/sfsca-crl.crl0+crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05u9.w?bjo@.a" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/priccertrulispca_2009-04-02.crlhhttp://crl.microspki/crl/products/miccertrulispca_2009-04-02.crl0q0o0mahttp://www.microsoft.com/pkmiccertrulispca_2009-04-02.crt0" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://microsoft.cok" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.mic1lssoration1+0)" - Source: "00000000-00003004.00000000.228014.02F1F000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003004.00000001.228079.02EB0000.00000004.mdmp") Found URL "https://arpausa.com.ec/5dun36pd.r9ic:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323\5dun36pd[1].r9i******************************ppxb0if9vrh10c6ws4pwfkkzcg5jt1lyueipcvijf2pu******************************mjwmcotfcvshjtnlzblkxiqpzqoicehpjyhcqbq03a9393aa2890feb858f73c8.bin.exebomnjppflr02w543v6ehgoorro4dadh70b******************************s5o8idmbyb4xrzukpzpszfrlvcnji1ro0346r5cpzbomnjppflr02w543v6ehgoorro4dadh70b******************************q2oh8qhcg663ixb16vtn1ase8t24dsg9ixpvrya6ux18************************************************************r1zndpvmznw78uo3bj1ulfkch4ngd7iv4u0fmb******************************mjwmcotfcvshjtnlzblkxiqpzqoicehpjyhcqbq03a9393aa2890feb858f73c8.bin.exebomnjppflr02w543v6ehgoorro4dadh70bs5o8idmbyb4xrzukpzpszfrlvcnji1ro0346r5cpzbomnjppflr02w543v6ehgoorro4dadh70bpflr02w543v6ehgoorro4dadh70batesarashrtreaarrhrrheeararrreaasrsccaerrcra93aa2890feb858f73c8.bin.exed613eef058e33aa2be3d058e47b2d493a7dcd1a503a9393aa2890feb858f73c8.bin.exebomnjppflr02w543v6ehgoorro4dadh70b0q(nne" - Source: "00000000-00003004.00000001.228079.02F1F000.00000004.mdmp") Found URL "https://arpausa.com.ec/5dun36pd.r9i:\windows\system32\ncryptsslp.dllttps://arpausa.com.ec/5dun36pd.r9ittps://arpausa.com.ec/5dun36pd.r9i:\program" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e%wvfkr!uglobalsign" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcsgkr46" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lkr*zentrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,-xgj0" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "https://arpausa.com.ec/]0[0,&http://cert.startcom.org/sfsca-crl.crl0+crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05u9.w?bjo@.a" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/priccertrulispca_2009-04-02.crlhhttp://crl.microspki/crl/products/miccertrulispca_2009-04-02.crl0q0o0mahttp://www.microsoft.com/pkmiccertrulispca_2009-04-02.crt0" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://microsoft.cok" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.mic1lssoration1+0)" - Source: "00000000-00003004.00000001.228079.02F45000.00000004.mdmp")3a:T7e8,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp, 00000000-00003004.00000001.228079.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp, 00000000-00003004.00000001.228079.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp, 00000000-00003004.00000001.228079.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp, 00000000-00003004.00000001.228079.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp, 00000000-00003004.00000001.228079.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp, 00000000-00003004.00000001.228079.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp, 00000000-00003004.00000001.228079.02EB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp, 00000000-00003004.00000001.228079.02EB0000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp")3b:T936,"" (Indicator: "base64"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "QaEsV" (Indicator: "aes"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp") Found string "BCRYPT_AES_ALGORITHM" (Indicator: "aes"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "ToBase64String" (Indicator: "base64"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "Rijndael" (Indicator: "rijndael"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "CryptoStream" (Indicator: "cryptostream"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "RNGCryptoServiceProvider" (Indicator: "rngcryptoserviceprovider"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "TripleDESCryptoServiceProvider" (Indicator: "tripledescryptoserviceprovider"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp")3d:Tac6,Found reference to API "11203877190,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.703",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11235465770,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11243181739,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11242075671,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11239737575,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11233182420,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11234831568,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11237267396,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11242645711,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11230402644,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11244220639,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11236557534,7360,3117,,FindFirstFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11233751690,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp") Found reference to API "11243701321,7360,3119,,FindNextFileA,kernel32.dll,"00:59:22.718",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00003004.00000000.228014.02EB0000.00000004.mdmp")3e:T7d7,Found string "passwordstorerc" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "*"password":"(.*?)"" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "server_user_password>" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "/server_user_password>" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "yncpassword" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "password>" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "/password>" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "k__BackingField" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "get_password" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "set_password" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp") Found string "passwordVaultPtr" (Indicator: "password"; Source: "00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp")3f:T566,"oftware\Microsoft\Office\11.0\Outlook\Profiles" in Source: 00000000-00003004.00000000.228014.06160000.00000004.mdmp 00000000-00003004.00000001.228079.06260000.00000040.mdmp "oftware\Microsoft\Office\12.0\Outlook\Profiles" in Source: 00000000-00003004.00000000.228014.06160000.00000004.mdmp 00000000-00003004.00000001.228079.06260000.00000040.mdmp "oftware\Microsoft\Office\14.0\Outlook\Profiles" in Source: 00000000-00003004.00000000.228014.06160000.00000004.mdmp 00000000-00003004.00000001.228079.06260000.00000040.mdmp "oftware\Microsoft\Office\15.0\Outlook\Profiles" in Source: 00000000-00003004.00000000.228014.06160000.00000004.mdmp 00000000-00003004.00000001.228079.06260000.00000040.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles" in Source: 00000000-00003004.00000000.228014.06160000.00000004.mdmp 00000000-00003004.00000001.228079.06260000.00000040.mdmp "VirtualStore\Program Files\Foxmail\mail" in Source: 00000000-00003004.00000000.228014.06160000.00000004.mdmp 00000000-00003004.00000001.228079.06260000.00000040.mdmp "VirtualStore\Program Files (x86)\Foxmail\mail" in Source: 00000000-00003004.00000000.228014.06160000.00000004.mdmp 00000000-00003004.00000001.228079.06260000.00000040.mdmp "Opera Mail\Opera Mail\wand.dat" in Source: 00000000-00003004.00000000.228014.06160000.00000004.mdmp 00000000-00003004.00000001.228079.06260000.00000040.mdmp40:T79c,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003004.00000000.228014.02EB0000.00000004.mdmp, 00000000-00003004.00000001.228079.02EB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e5c6a6d7a3c38d550d3bd6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e5c6a6d7a3c38d550d3bd6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003004.00000000.228014.06160000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003004.00000001.228079.06260000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69e5c6a6d7a3c38d550d3bd6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e5c6a6d7a3c38d550d3bd6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003004.00000000.228014.02EB0000.00000004.mdmp, 00000000-00003004.00000001.228079.02EB0000.00000004.mdmp\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00003004.00000000.228014.06160000.00000004.mdmp, 00000000-00003004.00000001.228079.06260000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e5c6a6d7a3c38d550d3bd6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" HTTP/1.1 200 OK\nConnection: Keep-Alive\nKeep-Alive: timeout=5\n max=100\nContent-Type: application/octet-stream\nLast-Modified: Fri\n 17 Apr 2026 13:09:55 GMT\nAccept-Ranges: bytes\nContent-Length: 239104\nDate: Mon\n 20 Apr 2026 06:25:10 GMT\nalt-svc: h3=\":443\"; ma=2592000\n h3-29=\":443\"; ma=2592000 with response body ==>076CC388365243434E4B594942C2BAC2A95156C28D4431555558515709463155444343385345355558465959354452355A4C3342424C474D504F4B3733344755.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69e5c6a6d7a3c38d550d3bd6"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e5c6a6d7a3c38d550d3bd6"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"RegAsm.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 708C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"69e5c6a6d7a3c38d550d3bd6"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"