24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T482,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Backdoor.Agent Sample de00c0111a56… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample de00c0111a56…. Malware family: Backdoor.Agent. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3","keywords":["Suspicious","Backdoor.Agent","malware analysis","sandbox report","threat intelligence","de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3"],"about":{"@type":"SoftwareApplication","name":"WinSCP.exe","applicationCategory":["peexe","executable"],"identifier":"de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"Backdoor.Agent","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T122a,Found reference to API (Indicator: "Toolhelp32ReadProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "NetLocalGroupAdd"; Source: "sample.bin"), Found reference to API (Indicator: "NetGroupAdd"; Source: "sample.bin"), Found reference to API (Indicator: "NetUserDel"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "NetApiBufferFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetCalendarInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "Module32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCalendarInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteVolumeMountPointW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryFullProcessImageName"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32Next"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32ListNext"; Source: "sample.bin"), Found reference to API (Indicator: "SetWaitableTimer"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "SetVolumeMountPointW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThread"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "Thread32First"; Source: "sample.bin"), Found reference to API (Indicator: "NetUserAdd"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleBaseNameA"; Source: "sample.bin"), Found reference to API (Indicator: "NetLocalGroupDel"; Source: "sample.bin"), Found reference to API (Indicator: "NetGroupEnum"; Source: "sample.bin"), Found reference to API (Indicator: "AnimateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "NetGroupDel"; Source: "sample.bin"), Found reference to API (Indicator: "Module32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "EnumCalendarInfoExW"; Source: "sample.bin"), Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "EnumDeviceDrivers"; Source: "sample.bin"), Found reference to API (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "sample.bin"), Found reference to API (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32ListFirst"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "NetLocalGroupEnum"; Source: "sample.bin"), Found reference to API (Indicator: "Thread32Next"; Source: "sample.bin"), Found reference to API (Indicator: "NetLocalGroupAddMembers"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryObject"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32First"; Source: "sample.bin"), Found reference to API (Indicator: "WakeConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointW"; Source: "sample.bin")26:T4da,"SYSTEM\CurrentControlSet\Control\Session Manager\Environment" in Source: sample.bin, "SOFTWARE\Microsoft\NET Framework Setup\NDP" in Source: sample.bin, "Software\9bis.com\KiTTY" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: sample.bin, "Software\SimonTatham\PuTTY" in Source: sample.bin, "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: sample.bin, "Software\Borland\Locales" in Source: sample.bin, "Software\Embarcadero\Locales" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall\winscp3_is1" in Source: sample.bin, "Software\Borland\Delphi\Locales" in Source: sample.bin, "Software\Classes\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: sample.bin, "SOFTWARE\Microsoft\PowerShell" in Source: sample.bin, "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: sample.bin, "Software\RegisteredApplications" in Source: sample.bin, "Software\Martin Prikryl" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: sample.bin, "Software\CodeGear\Locales" in Source: sample.bin27:Tb2a,file/memory contains long string with (Indicator: "public key"; Source: "sample.bin"), Found string "Using username "%s".*Using keyboard-interactive authentication.$Authenticating with public key "%s"." (Indicator: "public key"; Source: "sample.bin"), file/memory contains long string with (Indicator: "private key"; Source: "sample.bin"), Found string "NoAHost: %s User name: %s Private key file: %s Transfer protocol: %s" (Indicator: "private key"; Source: "sample.bin"), Found string "AA passphrase for an encrypted private key or a client certificate7Press 'No' to enable automatic saving of the workspace.,Selects the specified file in file panel(s)." (Indicator: "private key"; Source: "sample.bin"), Found string "Server refused our public key." (Indicator: "public key"; Source: "sample.bin"), Found string "Client certificate passphraseC**Do you want to convert this %s private key to PuTTY format?** %s" (Indicator: "private key"; Source: "sample.bin"), Found string "No tips.(Converting public keys is not supported." (Indicator: "public key"; Source: "sample.bin"), Found string "SSH private key file.#Fingerprint of server SSH host key. TLS/SSL client certificate file.!Passive mode (FTP protocol only).%Implicit TLS/SSL (FTP protocol only).%Explicit TLS/SSL (FTP protocol only)." (Indicator: "private key"; Source: "sample.bin"), Found string "Authenticating with public key "%"" (Indicator: "public key"; Source: "sample.bin"), Found string ""%s" file does not contain the public key line yet." (Indicator: "public key"; Source: "sample.bin"), Found string "Public key installation done." (Indicator: "public key"; Source: "sample.bin"), Found string "Unknown public key algorithm "%s"." (Indicator: "public key"; Source: "sample.bin"), Found string "Error decoding certificate. Error decoding certificate "%s".bCertificate file "%s" does not contain a public key and no corresponding .crt/.cer file was found." (Indicator: "public key"; Source: "sample.bin"), Found string "Adding public key line to "%s" file: %s" (Indicator: "public key"; Source: "sample.bin"), Found string "Access denied./Authenticating with public key "%s" from agent.!Trying public key authentication." (Indicator: "public key"; Source: "sample.bin"), Found string ""%s" file already contains public key line: %s" (Indicator: "public key"; Source: "sample.bin"), Found string "Authenticating with public key "%" from agent" (Indicator: "public key"; Source: "sample.bin"), Found string "Trying public key authentication." (Indicator: "public key"; Source: "sample.bin"), Found string "Invalid public key." (Indicator: "public key"; Source: "sample.bin"), Found string "Converts private key to .ppk format or edits key. Use %s to specify output file. Use %s to change or set passphrase. Use %s to change or set comment." (Indicator: "private key"; Source: "sample.bin")28:T72d,Found string " Do NOT distribute,The server supports these WebDAV extensions:" (Indicator: "webdav"; Source: "sample.bin"), Found string "WebDavLiberalEscaping" (Indicator: "webdav"; Source: "sample.bin"), Found string "OpenedSessionsWebDAVNginx" (Indicator: "webdav"; Source: "sample.bin"), Found string "WebDAV resource moved to '%s'." (Indicator: "webdav"; Source: "sample.bin"), file/memory contains long string with (Indicator: "webdav"; Source: "sample.bin"), Found string "OpenedSessionsWebDAVOther" (Indicator: "webdav"; Source: "sample.bin"), Found string "WebdavSecure" (Indicator: "webdav"; Source: "sample.bin"), Found string "https://www.openssl.org/)WebDAV/HTTP code based on neon library %s" (Indicator: "webdav"; Source: "sample.bin"), Found string "HttpForWebDAV" (Indicator: "webdav"; Source: "sample.bin"), Found string "WebDAV" (Indicator: "webdav"; Source: "sample.bin"), Found string "IT Hit WebDAV Server" (Indicator: "webdav"; Source: "sample.bin"), Found string "OpenedSessionsWebDAVS" (Indicator: "webdav"; Source: "sample.bin"), Found string "StoredSessionsCountWebDAV" (Indicator: "webdav"; Source: "sample.bin"), Found string "OpenedSessionsWebDAVIIS" (Indicator: "webdav"; Source: "sample.bin"), Found string "WebDAV: Tolerate non-encoded: %s" (Indicator: "webdav"; Source: "sample.bin"), Found string "OpenedSessionsWebDAVITHit" (Indicator: "webdav"; Source: "sample.bin"), Found string "OpenedSessionsWebDAV" (Indicator: "webdav"; Source: "sample.bin"), Found string "StoredSessionsCountWebDAVS" (Indicator: "webdav"; Source: "sample.bin"), Found string "OpenedSessionsWebDAVSPassport" (Indicator: "webdav"; Source: "sample.bin"), Found string "OpenedSessionsWebDAVSCertificate" (Indicator: "webdav"; Source: "sample.bin"), Found string "Using WebDAV protocol." (Indicator: "webdav"; Source: "sample.bin")29:T5de,Pattern match: "https://github.com/plashenkov/tbx'filemanager", Pattern match: "https://www.chiark.greenend.org.uk/~sgtatham/putty/licence.html", Pattern match: "www.chiark.greenend.org.uk/~sgtatham/putty/", Pattern match: "https://jrsoftware.org/tb2kdl.php", Pattern match: "https://jcl.delphi-jedi.org/", Pattern match: "http://www.w3.org/2003/05/soap-envelope", Pattern match: "https://filezilla-project.org/bthis", Pattern match: "http://www.w3.org/2001/xmlschema", Pattern match: "https://notroj.github.io/neon/", Pattern match: "http://www.w3.org/1999/xmlschema", Pattern match: "http://www.w3.org/2001/xmlschema-instance", Heuristic match: "storage.googleapis.com", Heuristic match: "ssh.com", Pattern match: "https://www.openssl.org/", Heuristic match: ".storage.googleapis.com", Pattern match: "http://schemas.xmlsoap.org/soap/envelope/", Heuristic match: "anonymous@example.com", Pattern match: "http://www.w3.org/2000/10/xmlschema", Heuristic match: "d.docs.live.net", Heuristic match: "digitaloceanspaces.com", Pattern match: "https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/license", Pattern match: "http://schemas.xmlsoap.org/soap/encoding/", Pattern match: "https://libexpat.github.io/", Pattern match: "http://www.w3.org/2003/05/soap-encoding", Pattern match: "http://www.borland.com/namespaces/types", Pattern match: "http://winscp.net/schema/session/1.0", Pattern match: "http://www.w3.org/2000/xmlns/", Pattern match: "https://github.com/uweraabe/pngcomponents"2a:Tda1,Observed string: "scp -r %s -d -f "%s"" (Indicator: "scp ") in Source: sample.bin, Observed string: "call With SFTP and SCP protocols, executes arbitrary remote shell command. If current session does not allow execution of arbitrary remote command separate shell session will be automatically opened. With FTP protocol, executes a protocol command. The command must not require user input. alias: ! example: call touch index.html Wecho Prints message onto script output. example: echo Starting upload... bstat Retrieves and lists attributes of specified remote file. example: stat index.html achecksum Calculates checksum of remote file. example: checksum sha-1 index.html " (Indicator: " scp ") in Source: sample.bin, Observed string: "scp -r %s -d -t "%s"" (Indicator: "scp ") in Source: sample.bin, Observed string: "SCP remote side confirmation (0)" (Indicator: "scp ") in Source: sample.bin, Observed string: "WinSCP is a popular free SFTP and FTP client for Windows, a powerful file manager that will improve your productivity. It supports also Amazon S3, FTPS, SCP and WebDAV protocols. Power users can automate WinSCP using .NET assembly. Loading...#%s Click here, to see what is new.(%d Resolving links and Reading directory" (Indicator: " scp ") in Source: sample.bin, Observed string: "SCP remote side error (1), fatal error detected from error message" (Indicator: "scp ") in Source: sample.bin, Observed string: "Using SCP protocol." (Indicator: " scp ") in Source: sample.bin, Observed string: "SCP remote side error (1)" (Indicator: "scp ") in Source: sample.bin, Observed string: "Binary transfer mode selected as the file is too large (%s) to be uploaded in Ascii mode using SCP protocol." (Indicator: " scp ") in Source: sample.bin, Observed string: "Sending SCP error (%d) to remote side:" (Indicator: " scp ") in Source: sample.bin, Observed string: "open open sftp|scp|ftp[es]|dav[s]|s3 :// [ [ :password ] @ ] [ : ] Establishes connection to given host. Use either name of the site or specify host, username, port and protocol directly. switches: -privatekey= SSH private key file -hostkey= Fingerprint of server host key (SFTP and SCP only). -clientcert= TLS/SSL client certificate file -certificate= Fingerprint of TLS/SSL certificate (FTPS and WebDAVS only) -passphrase= Private key passphrase -passive=on|off Passive mode (FTP protocol only) -implicit Implicit TLS/SSL (FTP protocol only) -explicit Explicit TLS/SSL (FTP protocol only) -timeout= Server response timeout -username= An alternative way to provide a username -password= An alternative way to provide a password -rawsettings setting1=value1 setting2=value2 ... Configures any site settings using raw format " (Indicator: " scp ") in Source: sample.bin, Observed string: "Cannot execute SCP to start transfer. Please make sure that SCP is installed on the server and path to it is included in PATH. You may also try SFTP instead of SCP./Location Profile with name '%s' already exists." (Indicator: " scp ") in Source: sample.bin, Observed string: " CORE_VARIABLE"SSH and SCP code based on PuTTY %s" (Indicator: " scp ") in Source: sample.bin, Observed string: "SCP remote side fatal error (2)" (Indicator: "scp ") in Source: sample.bin2b:T6f6,Found reference to API "Enumerated %d network events making %d cumulative events for socket %d" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Enumerating network events for socket %d" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Handling network %s event on socket %d with error %d" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Updating forwarding socket %d (%d)" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Selecting events %d for socket %d" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Destroying data socket on error" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Destroying data socket after transfer completed" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Error selecting events %d for socket %d" (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Internal error: Connect called while still connected" (Indicator: " connect "; Source: "sample.bin"), file/memory contains long string with (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Error enumerating network events for socket %d" (Indicator: " socket "; Source: "sample.bin"), Found reference to API ""FileZilla site "%s" was not found._You cannot connect to an SFTP server using an FTP protocol. Please select the correct protocol./Error occurred during logging. Cannot continue." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Unknown option '%s'."Unknown value '%s' of option '%s'.'Cannot determine status of socket (%d)." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Failed to get socket address " (Indicator: " socket "; Source: "sample.bin")2c:T48b,Found string "Certificate subject alternative name "%s" matches hostname" (Indicator: "hostname"; Source: "sample.bin"), file/memory contains long string with (Indicator: "hostname"; Source: "sample.bin"), Found string "HostName" (Indicator: "hostname"; Source: "sample.bin"), Found string "Certificate has no common name nor subject alternative name, not verifying hostname" (Indicator: "hostname"; Source: "sample.bin"), Found string "Ping type: %s, Ping interval: %d sec; Timeout: %d sec" (Indicator: "ping"; Source: "sample.bin"), Found string "Network error: No route to host" (Indicator: "route"; Source: "sample.bin"), Found string "Certificate subject alternative name "%s" does not match hostname" (Indicator: "hostname"; Source: "sample.bin"), Found string "%Cannot open site folder or workspace.)Network error: No route to host "%HOST%"./Network error: Software caused connection abort" (Indicator: "route"; Source: "sample.bin"), Found string "Certificate common name "%s" does not match hostname" (Indicator: "hostname"; Source: "sample.bin"), Found string "Certificate common name "%s" matches hostname" (Indicator: "hostname"; Source: "sample.bin")2d:Tad4,Found string "Current password (blank for previously entered password): " (Indicator: "password"; Source: "sample.bin"), Found string ", Logging passwords" (Indicator: "password"; Source: "sample.bin"), Found string "Master password: " (Indicator: "password"; Source: "sample.bin"), Found string "Master password" (Indicator: "password"; Source: "sample.bin"), Found string "=Configures any settings using a raw format as in an INI file.OUpdates settings of sites matching a mask using a raw format as in an INI file.!Turns on session logging to file.7Logging level (0..2), add * to enable password logging." (Indicator: "password"; Source: "sample.bin"), Found string "&Re-enter master password:-Save &password (protected by master password)" (Indicator: "password"; Source: "sample.bin"), Found string "&Save workspace as:!Save &passwords (not recommended).Save &passwords (protected by master password)" (Indicator: "password"; Source: "sample.bin"), Found string "!The password cannot be decrypted.6You did not enter the correct current master password.5New and re-entered master passwords are not the same." (Indicator: "password"; Source: "sample.bin"), Found string "FTP Proxy password" (Indicator: "password"; Source: "sample.bin"), Found string ")Authenticating with pre-entered password." (Indicator: "password"; Source: "sample.bin"), Found string "New SSH password" (Indicator: "password"; Source: "sample.bin"), Found string "newpassword" (Indicator: "password"; Source: "sample.bin"), Found string "&Current password:" (Indicator: "password"; Source: "sample.bin"), Found string "Proxy password" (Indicator: "password"; Source: "sample.bin"), Found string "[mysession] [/%s= [/%s=]]" (Indicator: "password"; Source: "sample.bin"), Found string "Using stored password." (Indicator: "password"; Source: "sample.bin"), Found string "Using stored password and new password." (Indicator: "password"; Source: "sample.bin"), Found string "new password" (Indicator: "password"; Source: "sample.bin"), Found string "Server asked for password, but we are using certificate, and no password was specified upfront, using fake password" (Indicator: "password"; Source: "sample.bin"), file/memory contains long string with (Indicator: "password"; Source: "sample.bin"), Found string "&New master password:" (Indicator: "password"; Source: "sample.bin"), Found string "(sftp|scp|ftp[es]|dav[s]|s3)://[user[:password]@]host[:port][/path/[file]]" (Indicator: "password"; Source: "sample.bin"), Found string "password" (Indicator: "password"; Source: "sample.bin"), Found string "Using remembered password." (Indicator: "password"; Source: "sample.bin"), Found string "&Site name: Save &password (not recommended)" (Indicator: "password"; Source: "sample.bin")2e:T4bf,Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API "Module32FirstW" (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "sample.bin"), Found reference to API "Module32NextW" (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API "Module32First" (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "sample.bin"), Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API "Process32First" (Indicator: "Process32First"; Source: "sample.bin")2f:T68b,Found string "ECDSA/nistp256" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "blowfish" (Indicator: "blowfish"; Source: "sample.bin"), Found string "chacha20" (Indicator: "chacha"; Source: "sample.bin"), Found string "bin.base64" (Indicator: "base64"; Source: "sample.bin"), Found string "Diffie-Hellman group exchange" (Indicator: "diffie-hellman"; Source: "sample.bin"), Found string "base64Binary" (Indicator: "base64"; Source: "sample.bin"), Found string "ecdsa" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "AES-256" (Indicator: "aes"; Source: "sample.bin"), Found string "Diffie-Hellman group 1" (Indicator: "diffie-hellman"; Source: "sample.bin"), Found string "base64" (Indicator: "base64"; Source: "sample.bin"), Found string ".aesctr.enc" (Indicator: "aes"; Source: "sample.bin"), Found string "ChaCha20" (Indicator: "chacha"; Source: "sample.bin"), Found string "3des" (Indicator: "3des"; Source: "sample.bin"), Found string "Base64: %s DER: %s" (Indicator: "base64"; Source: "sample.bin"), Found string "ECDSA/nistp521" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "3DES" (Indicator: "3des"; Source: "sample.bin"), Found string "Diffie-Hellman group 14" (Indicator: "diffie-hellman"; Source: "sample.bin"), Found string "Auto[**Master password successfully set.** Your stored passwords are secured by AES cipher now.%Master password successfully changed.V**You have deleted your master password.** Your stored passwords are not secured now." (Indicator: "aes"; Source: "sample.bin"), Found string "Blowfish" (Indicator: "blowfish"; Source: "sample.bin"), Found string "ECDSA/nistp384" (Indicator: "ecdsa"; Source: "sample.bin")30:T1204,Observed string: "call With SFTP and SCP protocols, executes arbitrary remote shell command. If current session does not allow execution of arbitrary remote command separate shell session will be automatically opened. With FTP protocol, executes a protocol command. The command must not require user input. alias: ! example: call touch index.html Wecho Prints message onto script output. example: echo Starting upload... bstat Retrieves and lists attributes of specified remote file. example: stat index.html achecksum Calculates checksum of remote file. example: checksum sha-1 index.html " (Indicator: " sftp ") in Source: sample.bin, Observed string: "Cannot get real path for '%s'.&Cannot change properties of file '%s'.DCannot initialize SFTP protocol. Is the host running an SFTP server?!Cannot read time zone information" (Indicator: " sftp ") in Source: sample.bin, Observed string: "The server rejected SFTP connection, but it listens for FTP connections. Did you want to use FTP protocol instead of SFTP? Prefer using encryption.dOpening session using command-line parameter in scripting is deprecated. Use 'open' command instead.EWARNING! Giving up security and accepting any host key as configured!HWARNING! Giving up security and accepting any certificate as configured!" (Indicator: " sftp ") in Source: sample.bin, Observed string: "SFTP-%d:The version of SFTP protocol does not allow file renaming./The server does not support any SFTP extension.*The server supports these SFTP extensions:" (Indicator: " sftp ") in Source: sample.bin, Observed string: "We believe the server has SFTP symlink bug" (Indicator: " sftp ") in Source: sample.bin, Observed string: "WinSCP is a popular free SFTP and FTP client for Windows, a powerful file manager that will improve your productivity. It supports also Amazon S3, FTPS, SCP and WebDAV protocols. Power users can automate WinSCP using .NET assembly. Loading...#%s Click here, to see what is new.(%d Resolving links and Reading directory" (Indicator: " sftp ") in Source: sample.bin, Observed string: "We will use UTF-8 strings until server sends an invalid UTF-8 string as with SFTP version 3 and older UTF-8 strings are not mandatory" (Indicator: " sftp ") in Source: sample.bin, Observed string: "We will use UTF-8 strings as it is mandatory with SFTP version 4 and newer" (Indicator: " sftp ") in Source: sample.bin, Observed string: "SFTP" (Indicator: "sftp") in Source: sample.bin, Observed string: "Using SFTP protocol." (Indicator: " sftp ") in Source: sample.bin, Observed string: "Forcing workaround for SFTP link bug" (Indicator: " sftp ") in Source: sample.bin, Observed string: "SFTP (SCP)" (Indicator: "sftp ") in Source: sample.bin, Observed string: "SFTP versions supported by the server: %s" (Indicator: "sftp ") in Source: sample.bin, Observed string: "We believe the server has SFTP link bug" (Indicator: " sftp ") in Source: sample.bin, Observed string: "Fatal error while disposing the SFTP queue." (Indicator: " sftp ") in Source: sample.bin, Observed string: "SFTP keyfiles" (Indicator: "sftp ") in Source: sample.bin, Observed string: "sftp" (Indicator: "sftp") in Source: sample.bin, Observed string: "SFTP versions supported by the server (VShell format): %s" (Indicator: "sftp ") in Source: sample.bin, Observed string: "Cannot execute SCP to start transfer. Please make sure that SCP is installed on the server and path to it is included in PATH. You may also try SFTP instead of SCP./Location Profile with name '%s' already exists." (Indicator: " sftp ") in Source: sample.bin, Observed string: "SFTP Real Path: %s" (Indicator: "sftp ") in Source: sample.bin, Observed string: "Error while disposing the SFTP queue." (Indicator: " sftp ") in Source: sample.bin, Observed string: "SFTP Bugs: %s" (Indicator: "sftp ") in Source: sample.bin, Observed string: "SFTP Server: %s" (Indicator: "sftp ") in Source: sample.bin, Observed string: "Error deleting file '%s'. After resumable file upload the existing destination file must be deleted. If you do not have permissions to delete file destination file, you need to disable resumable file transfers.(Error decoding SFTP packet (%d, %d, %d).,Invalid name '%s'. Name cannot contain '%s'.EThe file could not be opened because it is locked by another process." (Indicator: " sftp ") in Source: sample.bin, Observed string: "NVersion of SFTP server (%d) is not supported. Supported versions are %d to %d.ASFTP protocol violation: Invalid message number %d (expected %d)." (Indicator: " sftp ") in Source: sample.bin1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1790268916018,"unified_at":"2026-09-24T16:55:16.018Z","metadata":{"hashes":{"sha256":"de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3","sha1":"78c9fe7590df8252e01ccfc4dccc79c30d580994","md5":"8df48fa69cb7b4c99939702caa70d1a9","imphash":"c624b01828ff0c772651180cf423b25e","pehash":"e152925b72a1e001d94e29393596a878216dd7d4"},"file_info":{"file_name":"WinSCP.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":27022400,"entropy":6.96,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1788372418000,"last_seen":1788372418000,"last_multi_scan":1788372418000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":40},"sandbox_signatures":{"informative_count":56,"suspicious_count":6,"malicious_count":0,"total":62},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Agent.Win32.82900","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Backdoor.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to add users to a group (API string)"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Permission Groups Discovery","attack_id":"T1069","attack_id_wiki":"https://attack.mitre.org/techniques/T1069","identifiers":[{"type":"informative","value":"Contains ability to enumerate user groups or their members (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer files remotely using SFTP"},{"type":"informative","value":"Contains ability to transfer files using SCP"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"suspicious","value":"Identified FTP credentials location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"},{"type":"suspicious","value":"YARA signature match - RMM tools"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete users from a group (API string)"},{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"suspicious","value":"YARA signature match - Office macro contains PowerShell commands"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - Office macro contains PowerShell commands","description":"YARA signature to detect PowerShell in Office macros matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1059.005","id":"yara-29","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\", YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-44","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - RMM tools","description":"YARA signature to detect winscp RMM tool file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1219","id":"yara-557","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$25","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\" Alex A. Denisov and contributors!https://github.com/plashenkov/TBX'Filemanager Toolset library Version 2.6\" (Indicator: \"github.com\"), \"d.docs.live.net\" (Indicator: \"docs.live.net\"), \"https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE\" (Indicator: \"github.com\"), \" Uwe Raabe and Martijn Saly)https://github.com/UweRaabe/PngComponents\tSaving...\" (Indicator: \"github.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to add users to a group (API string)","description":"Found reference to API \"NetLocalGroupAdd\" (Indicator: \"NetLocalGroupAdd\"; Source: \"sample.bin\"), Found reference to API \"NetGroupAdd\" (Indicator: \"NetGroupAdd\"; Source: \"sample.bin\"), Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAdd\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-215","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$26","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"SymLoadModule\" (Indicator: \"LoadModule\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-424","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"Write-Host\" (Indicator: \"Write-Host\"; Source: \"sample.bin\"), Found string \"New-Object\" (Indicator: \"New-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"anonymous@example.com\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"Found reference to API \"NetUserAdd\" (Indicator: \"NetUserAdd\"; Source: \"sample.bin\"), Found reference to API \"NetLocalGroupAddMembers\" (Indicator: \"NetLocalGroupAddMembers\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1136.001","id":"string-214","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumDeviceDrivers\" (Indicator: \"EnumDeviceDrivers\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"-t -m \"%TEMP%\\putty.txt\" !`cmd.exe /c echo cd '!/' ; /bin/bash -login > \"%TEMP%\\putty.txt\"`\" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-174","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$27","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"$28","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-476","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\", Found HTTPS url \"https://www.chiark.greenend.org.uk\", Found HTTPS url \"https://jrsoftware.org\", Found HTTPS url \"https://jcl.delphi\", Found HTTPS url \"https://filezilla\", Found HTTPS url \"https://notroj.github.io\", Found HTTPS url \"https://www.openssl.org\", Found HTTPS url \"https://libexpat.github.io\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer files using SCP","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-577","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$2b","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"storage.googleapis.com\" (Indicator: \".googleapis.com\"; Source: \"sample.bin\"), Found string \".storage.googleapis.com\" (Indicator: \".googleapis.com\"; Source: \"sample.bin\"), Found string \"d.docs.live.net\" (Indicator: \"docs.live.net\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping type: %s, Ping interval: %d sec; Timeout: %d sec\" (Indicator: \"ping \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$2c","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$2d","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$2e","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$2f","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \":GSSAPI/SSPI with Kerberos is not supported on this system.\" (Indicator: \"kerberos\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1558","id":"string-868","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\winscp3_is1\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"Dir already exists in cache!\" (Indicator: \"dir \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-328","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Identified FTP credentials location strings","description":"\"FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1552.001","id":"string-11","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate user groups or their members (API string)","description":"Found reference to API \"NetGroupEnum\" (Indicator: \"NetGroupEnum\"; Source: \"sample.bin\"), Found reference to API \"NetLocalGroupEnum\" (Indicator: \"NetLocalGroupEnum\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1069","id":"string-219","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameEx\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \" Alex A. Denisov and contributors!https://github.com/plashenkov/TBX'Filemanager Toolset library Version 2.6\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"https://github.com/bji/libs30https://github.com/bji/libs3/blob/master/LICENSE\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \" Uwe Raabe and Martijn Saly)https://github.com/UweRaabe/PngComponents\tSaving...\" (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\winscp3_is1\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"SetVolumeMountPointW\" (Indicator: \"SetVolumeMountPoint\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1006","id":"string-194","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set up session options\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set permissions: %s\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-324","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-162","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to transfer files remotely using SFTP","description":"$30","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-578","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"Found string \"Ignoring empty SSH server authentication request\" (Indicator: \" ssh \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" ssh \"; Source: \"sample.bin\"), Found string \"New SSH password\" (Indicator: \" ssh \"; Source: \"sample.bin\"), Found string \"SSH private key file.#Fingerprint of server SSH host key. TLS/SSL client certificate file.!Passive mode (FTP protocol only).%Implicit TLS/SSL (FTP protocol only).%Explicit TLS/SSL (FTP protocol only).\" (Indicator: \" ssh \"; Source: \"sample.bin\"), Found string \"Momentum SSH Server\" (Indicator: \" ssh \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1219","id":"string-883","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1531","id":"string-216","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete users from a group (API string)","description":"Found reference to API \"NetLocalGroupDel\" (Indicator: \"NetLocalGroupDel\"; Source: \"sample.bin\"), Found reference to API \"NetGroupDel\" (Indicator: \"NetGroupDel\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1531","id":"string-218","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-223","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1574.007","id":"string-530","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"Found string \"Add-Type\" (Indicator: \"Add-Type\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-396","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"BugHMAC2\" (Indicator: \"HMAC\"; Source: \"sample.bin\"), Found reference to \"XSHA512\" (Indicator: \"SHA512\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"Found reference string \"NetGroupEnum\" (Indicator: \"netgroupenum\"; Source: \"sample.bin\"), Found reference string \"NetLocalGroupEnum\" (Indicator: \"netlocalgroupenum\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1069.002","id":"string-981","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:5269ab31b087be07533d9646a8a3510399a7b6a23ac167b866f38c5d32b10fac":{"type":"File","value":"5269ab31b087be07533d9646a8a3510399a7b6a23ac167b866f38c5d32b10fac","filetype":"data (from pe_extract_certificates)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3":{"type":"File","value":"de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]},"filetype":"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows","filetype_short":"PE32","mime_type":"application/x-dosexec"}},"chains":[{"id":"1544770656219282936","root":"File:de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"1544770654005932635","root":"File:de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3","to_key":"File:5269ab31b087be07533d9646a8a3510399a7b6a23ac167b866f38c5d32b10fac"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3","edges":[{"edge_kind":"extracted","from_key":"File:de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3","to_key":"File:5269ab31b087be07533d9646a8a3510399a7b6a23ac167b866f38c5d32b10fac"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"5269ab31b087be07533d9646a8a3510399a7b6a23ac167b866f38c5d32b10fac","sha256":"5269ab31b087be07533d9646a8a3510399a7b6a23ac167b866f38c5d32b10fac","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Backdoor.Agent Sample de00c0111a56… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample de00c0111a56…. Malware family: Backdoor.Agent. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3"}],["$","meta","4",{"property":"og:title","content":"Suspicious Backdoor.Agent Sample de00c0111a56… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample de00c0111a56…. Malware family: Backdoor.Agent. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/de00c0111a561e88d62fd84f425a6febc72e01e2e927fb76d01603319a34b4b3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Backdoor.Agent Sample de00c0111a56… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample de00c0111a56…. Malware family: Backdoor.Agent. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]