26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 50:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Doina.Generic Sample de05caadc10e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample de05caadc10e…. Malware family: Doina.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0","keywords":["Malicious","Doina.Generic","malware analysis","sandbox report","threat intelligence","de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0"],"about":{"@type":"SoftwareApplication","name":"jusched.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Doina.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T490,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp")28:T74e,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp")29:T1933,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000160.00000000.298320.B9DC0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000160.00000000.298320.B9DC0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000184.00000000.298713.A74E0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000184.00000000.298713.A74E0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000588.00000000.307833.935C0000.00000004.mdmp, 00000000-00000896.00000000.300672.C5750000.00000004.mdmp, 00000000-00000896.00000000.300672.F1B40000.00000002.mdmp, 00000000-00000952.00000000.304208.280E0000.00000004.mdmp, 00000000-00001168.00000000.306191.29890000.00000004.mdmp, 00000000-00001388.00000000.305389.47BC0000.00000004.mdmp, 00000000-00003432.00000000.301445.DD370000.00000004.mdmp, 00000000-00003588.00000000.306997.09E30000.00000004.mdmp, 00000000-00003832.00000000.308213.2A440000.00000004.mdmp, 00000000-00004036.00000000.307415.E9130000.00000004.mdmp, 00000000-00004332.00000000.301055.25130000.00000004.mdmp, 00000000-00004732.00000000.300277.B1CC0000.00000004.mdmp, 00000000-00004820.00000000.299892.A6460000.00000004.mdmp, 00000000-00005848.00000000.306612.E3E00000.00000004.mdmp, 00000000-00006008.00000000.302598.31390000.00000004.mdmp, 00000000-00006084.00000000.303410.FE820000.00000004.mdmp, 00000000-00006164.00000000.303016.023A0000.00000004.mdmp, 00000000-00006696.00000000.304591.3B800000.00000004.mdmp, 00000000-00007976.00000000.305800.7D650000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000588.00000000.307833.935C0000.00000004.mdmp, 00000000-00000896.00000000.300672.C5750000.00000004.mdmp, 00000000-00000896.00000000.300672.F1B40000.00000002.mdmp, 00000000-00000952.00000000.304208.280E0000.00000004.mdmp, 00000000-00001168.00000000.306191.29890000.00000004.mdmp, 00000000-00001388.00000000.305389.47BC0000.00000004.mdmp, 00000000-00003432.00000000.301445.DD370000.00000004.mdmp, 00000000-00003588.00000000.306997.09E30000.00000004.mdmp, 00000000-00003832.00000000.308213.2A440000.00000004.mdmp, 00000000-00004036.00000000.307415.E9130000.00000004.mdmp, 00000000-00004332.00000000.301055.25130000.00000004.mdmp, 00000000-00004732.00000000.300277.B1CC0000.00000004.mdmp, 00000000-00004820.00000000.299892.A6460000.00000004.mdmp, 00000000-00005848.00000000.306612.E3E00000.00000004.mdmp, 00000000-00006008.00000000.302598.31390000.00000004.mdmp, 00000000-00006084.00000000.303410.FE820000.00000004.mdmp, 00000000-00006164.00000000.303016.023A0000.00000004.mdmp, 00000000-00006696.00000000.304591.3B800000.00000004.mdmp, 00000000-00007976.00000000.305800.7D650000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002220.00000000.296644.851D0000.00000004.mdmp, 00000000-00002220.00000001.298564.851D0000.00000004.mdmp, 00000000-00002220.00000002.300486.851D0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002220.00000000.296644.851D0000.00000004.mdmp, 00000000-00002220.00000001.298564.851D0000.00000004.mdmp, 00000000-00002220.00000002.300486.851D0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002264.00000000.297622.68080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002264.00000000.297622.68080000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002472.00000000.297958.F8F10000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002472.00000000.297958.F8F10000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005612.00000000.299090.AE930000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005612.00000000.299090.AE930000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00007812.00000000.299484.48550000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00007812.00000000.299484.48550000.00000004.mdmp")2a:T809,"#" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000000.296644.8522F000.00000004.mdmp") Found string "Content-Length4POST /Psd8eZaW/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000000.296644.8522F000.00000004.mdmp, 00000000-00002220.00000001.298564.8522B000.00000004.mdmp") Found string "HTTP/1.1 404 Not Found6O#" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000000.296644.8522F000.00000004.mdmp") Found string "POST /Psd8eZaW/index.php HTTP/1.1Q`#" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000000.296644.8522F000.00000004.mdmp") Found string "POST /h84jjfAr/index.php HTTP/1.1aq#" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000000.296644.8522F000.00000004.mdmp, 00000000-00002220.00000002.300486.85224000.00000004.mdmp") Found string "Content-Length4POST /h84jjfAr/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000000.296644.8522F000.00000004.mdmp, 00000000-00002220.00000001.298564.8522B000.00000004.mdmp, 00000000-00002220.00000002.300486.85224000.00000004.mdmp") Found string "POST /Psd8eZaW/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000000.296644.8522F000.00000004.mdmp, 00000000-00002220.00000001.298564.8522B000.00000004.mdmp, 00000000-00002220.00000002.300486.85224000.00000004.mdmp") Found string "ndex.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000000.296644.8522F000.00000004.mdmp, 00000000-00002220.00000002.300486.85224000.00000004.mdmp") Found string "Content-Length176POST /Psd8eZaW/index.php HTTP/1.1S" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000001.298564.8522B000.00000004.mdmp") Found string "Content-Length4POST /Psd8eZaW/index.php HTTP/1.1q" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000001.298564.8522B000.00000004.mdmp") Found string "POST /Psd8eZaW/index.php HTTP/1.1!-#" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000001.298564.8522B000.00000004.mdmp") Found string "Content-Length176POST /h84jjfAr/index.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000001.298564.8522B000.00000004.mdmp, 00000000-00002220.00000002.300486.85224000.00000004.mdmp") Found string "POST /h84jjfAr/index.php HTTP/1.1AO#" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000001.298564.8522B000.00000004.mdmp, 00000000-00002220.00000002.300486.85224000.00000004.mdmp") Found string "HTTP/1.1 200 OKOq#" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000001.298564.8522B000.00000004.mdmp") Found string "HTTP/1.1 200 OK_" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000001.298564.8522B000.00000004.mdmp, 00000000-00002220.00000002.300486.85224000.00000004.mdmp") Found string "Content-Length4POST /Psd8eZaW/index.php HTTP/1.1Q" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000002.300486.85224000.00000004.mdmp") Found string "Content-Length176POST /Psd8eZaW/index.php HTTP/1.1c" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000002.300486.85224000.00000004.mdmp") Found string "HTTP/1.1 404 Not Found&>#" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000002.300486.85224000.00000004.mdmp") Found string "HTTP/1.1 200 OK?`#" (Indicator: "HTTP/1.1"; Source: "00000000-00002220.00000002.300486.85224000.00000004.mdmp")45:T46a,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp")46:T477,Found registry query API: "RegEnumValueA" in file "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin" Found registry query API: "RegOpenKeyExA" in file "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin" Found registry query API: "RegQueryInfoKeyW" in file "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin" Found registry query API: "RegQueryValueExA" in file "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin" Found registry query API: "RegGetValueA" in file "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin" Found registry query API: "RegEnumValueA" in "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp" Found registry query API: "RegGetValueA" in "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp"47:T84a,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp")48:T734,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp")49:T14c2,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000160.00000000.298320.B9DC0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\08e25196df\jusched.exe" (Indicator: "\Device\"; Source: "00000000-00000160.00000000.298320.B9DC0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000184.00000000.298713.A74E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\08e25196df\jusched.exe" (Indicator: "\Device\"; Source: "00000000-00000184.00000000.298713.A74E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000588.00000000.307833.935C0000.00000004.mdmp, 00000000-00000896.00000000.300672.C5750000.00000004.mdmp, 00000000-00000952.00000000.304208.280E0000.00000004.mdmp, 00000000-00001168.00000000.306191.29890000.00000004.mdmp, 00000000-00001388.00000000.305389.47BC0000.00000004.mdmp, 00000000-00003432.00000000.301445.DD370000.00000004.mdmp, 00000000-00003588.00000000.306997.09E30000.00000004.mdmp, 00000000-00003832.00000000.308213.2A440000.00000004.mdmp, 00000000-00004036.00000000.307415.E9130000.00000004.mdmp, 00000000-00004112.00000000.304984.C1210000.00000004.mdmp, 00000000-00004332.00000000.301055.25130000.00000004.mdmp, 00000000-00004336.00000000.308603.8B830000.00000004.mdmp, 00000000-00004612.00000000.303804.C0800000.00000004.mdmp, 00000000-00004732.00000000.300277.B1CC0000.00000004.mdmp, 00000000-00004820.00000000.299892.A6460000.00000004.mdmp, 00000000-00005724.00000000.302230.BC740000.00000004.mdmp, 00000000-00005848.00000000.306612.E3E00000.00000004.mdmp, 00000000-00006008.00000000.302598.31390000.00000004.mdmp, 00000000-00006084.00000000.303410.FE820000.00000004.mdmp, 00000000-00006164.00000000.303016.023A0000.00000004.mdmp, 00000000-00006696.00000000.304591.3B800000.00000004.mdmp, 00000000-00006748.00000000.301830.4AC50000.00000004.mdmp, 00000000-00007976.00000000.305800.7D650000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\08e25196df\jusched.exe" (Indicator: "\Device\"; Source: "00000000-00000588.00000000.307833.935C0000.00000004.mdmp, 00000000-00000896.00000000.300672.C5750000.00000004.mdmp, 00000000-00000952.00000000.304208.280E0000.00000004.mdmp, 00000000-00001168.00000000.306191.29890000.00000004.mdmp, 00000000-00001388.00000000.305389.47BC0000.00000004.mdmp, 00000000-00003432.00000000.301445.DD370000.00000004.mdmp, 00000000-00003588.00000000.306997.09E30000.00000004.mdmp, 00000000-00003832.00000000.308213.2A440000.00000004.mdmp, 00000000-00004036.00000000.307415.E9130000.00000004.mdmp, 00000000-00004112.00000000.304984.C1210000.00000004.mdmp, 00000000-00004332.00000000.301055.25130000.00000004.mdmp, 00000000-00004336.00000000.308603.8B830000.00000004.mdmp, 00000000-00004612.00000000.303804.C0800000.00000004.mdmp, 00000000-00004732.00000000.300277.B1CC0000.00000004.mdmp, 00000000-00004820.00000000.299892.A6460000.00000004.mdmp, 00000000-00005724.00000000.302230.BC740000.00000004.mdmp, 00000000-00006008.00000000.302598.31390000.00000004.mdmp, 00000000-00006164.00000000.303016.023A0000.00000004.mdmp, 00000000-00006696.00000000.304591.3B800000.00000004.mdmp, 00000000-00006748.00000000.301830.4AC50000.00000004.mdmp, 00000000-00007976.00000000.305800.7D650000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002220.00000000.296644.851D0000.00000004.mdmp, 00000000-00002220.00000001.298564.851D0000.00000004.mdmp, 00000000-00002220.00000002.300486.851D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\08e25196df\jusched.exe" (Indicator: "\Device\"; Source: "00000000-00002220.00000000.296644.851D0000.00000004.mdmp, 00000000-00002220.00000001.298564.851D0000.00000004.mdmp, 00000000-00002220.00000002.300486.851D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002264.00000000.297622.68080000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\08e25196df\jusched.exe" (Indicator: "\Device\"; Source: "00000000-00002264.00000000.297622.68080000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002472.00000000.297958.F8F10000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\08e25196df\jusched.exe" (Indicator: "\Device\"; Source: "00000000-00002472.00000000.297958.F8F10000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005612.00000000.299090.AE930000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\08e25196df\jusched.exe" (Indicator: "\Device\"; Source: "00000000-00005612.00000000.299090.AE930000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007812.00000000.299484.48550000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\08e25196df\jusched.exe" (Indicator: "\Device\"; Source: "00000000-00007812.00000000.299484.48550000.00000004.mdmp")4a:T4f8,Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00000896.00000000.300672.F1B40000.00000002.mdmp")4b:Ta14," "st=s" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:00 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:01 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:02 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:02 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:03 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:03 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:04 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:04 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:05 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E333C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:05 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body "POST /Psd8eZaW/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.104 Content-Length: 176 Cache-Control: no-cache" with payload::==> "r=A6D3B938E7305CD82E77E3435910B0974548449F24973F5DAD377CD1BF2D1EF8BA94957271F2F0199EAB0F7AA704BB977FCE8F8DF037BCF92EA876C51FBFC8D0521B675433F3A96E864639E62DF5C60788A6B67AC79037" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 06 Jun 2026 06:04:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive with response body ==>203C633E3C643E....... "POST /h84jjfAr/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 196.251.107.130 Content-Length: 4 Cache-Control: no-cache" with payload::==> "st=s" HTTP/1.1 404 Not Found Date: Sat 06 Jun 2026 06:04:06 GMT Server: Apache/2.4.58 (Ubuntu) Last-Modified: Wed 15 Apr 2026 13:48:10 GMT ETag: "0-64f7ff7607a80" Accept-Ranges: bytes Content-Length: 0 Content-Type: text/html with no response body4f:T42b,16/26 Antivirus vendors marked spawned process "jusched.exe" (PID: 2220) as malicious (classified as "Downloader.Amadey.Win64" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "jusched.exe" (PID: 2264) as malicious (classified as "Downloader.Amadey.Win64" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "jusched.exe" (PID: 2472) as malicious (classified as "Downloader.Amadey.Win64" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "jusched.exe" (PID: 160) as malicious (classified as "Downloader.Amadey.Win64" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "jusched.exe" (PID: 184) as malicious (classified as "Downloader.Amadey.Win64" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "jusched.exe" (PID: 5612) as malicious (classified as "Downloader.Amadey.Win64" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "jusched.exe" (PID: 7812) as malicious (classified as "Downloader.Amadey.Win64" with 61% detection rate)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792582864969,"unified_at":"2026-10-21T11:41:04.969Z","metadata":{"hashes":{"sha256":"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0","sha1":"48b9c278d131df429c1aed74d7a4f20c372712e6","md5":"851002f48a6dd00c41532bcc749bfd6a","sha512":"ad58ff0a9dc531218905d257e2eb455c1b71aed6bbb2deccbdcbacf3dec158bc1f384c88abed8bd6719942d56070e11835828f9a8452881097f910badc897567","ssdeep":"6144:LyB4DWmxd3DH+SOe3I3qEQ1kRtFlHvNzubRDePTRBhUCaraPOlfj1ohPVL8On:Lyi5h+SU3VQ1kRDhv0ibRQnolVLN","ssdeep_chunks":["6144:LyB4DWm","6144:yB4DWmx","6144:B4DWmxd","6144:4DWmxd3","6144:DWmxd3D","6144:Wmxd3DH","6144:mxd3DH+","6144:xd3DH+S","6144:d3DH+SO","6144:3DH+SOe","6144:DH+SOe3","6144:H+SOe3I","6144:+SOe3I3","6144:SOe3I3q","6144:Oe3I3qE","6144:e3I3qEQ","6144:3I3qEQ1","6144:I3qEQ1k","6144:3qEQ1kR","6144:qEQ1kRt","6144:EQ1kRtF","6144:Q1kRtFl","6144:1kRtFlH","6144:kRtFlHv","6144:RtFlHvN","6144:tFlHvNz","6144:FlHvNzu","6144:lHvNzub","6144:HvNzubR","6144:vNzubRD","6144:NzubRDe","6144:zubRDeP","6144:ubRDePT","6144:bRDePTR","6144:RDePTRB","6144:DePTRBh","6144:ePTRBhU","6144:PTRBhUC","6144:TRBhUCa","6144:RBhUCar","6144:BhUCara","6144:hUCaraP","6144:UCaraPO","6144:CaraPOl","6144:araPOlf","6144:raPOlfj","6144:aPOlfj1","6144:POlfj1o","6144:Olfj1oh","6144:lfj1ohP","6144:fj1ohPV","6144:j1ohPVL","6144:1ohPVL8","6144:ohPVL8O","6144:hPVL8On","12288:LyB4DWm","12288:yB4DWmx","12288:B4DWmxd","12288:4DWmxd3","12288:DWmxd3D","12288:Wmxd3DH","12288:mxd3DH+","12288:xd3DH+S","12288:d3DH+SO","12288:3DH+SOe","12288:DH+SOe3","12288:H+SOe3I","12288:+SOe3I3","12288:SOe3I3q","12288:Oe3I3qE","12288:e3I3qEQ","12288:3I3qEQ1","12288:I3qEQ1k","12288:3qEQ1kR","12288:qEQ1kRt","12288:EQ1kRtF","12288:Q1kRtFl","12288:1kRtFlH","12288:kRtFlHv","12288:RtFlHvN","12288:tFlHvNz","12288:FlHvNzu","12288:lHvNzub","12288:HvNzubR","12288:vNzubRD","12288:NzubRDe","12288:zubRDeP","12288:ubRDePT","12288:bRDePTR","12288:RDePTRB","12288:DePTRBh","12288:ePTRBhU","12288:PTRBhUC","12288:TRBhUCa","12288:RBhUCar","12288:BhUCara","12288:hUCaraP","12288:UCaraPO","12288:CaraPOl","12288:araPOlf","12288:raPOlfj","12288:aPOlfj1","12288:POlfj1o","12288:Olfj1oh","12288:lfj1ohP","12288:fj1ohPV","12288:j1ohPVL","12288:1ohPVL8","12288:ohPVL8O","12288:hPVL8On","6144:Lyi5h+S","6144:yi5h+SU","6144:i5h+SU3","6144:5h+SU3V","6144:h+SU3VQ","6144:+SU3VQ1","6144:SU3VQ1k","6144:U3VQ1kR","6144:3VQ1kRD","6144:VQ1kRDh","6144:Q1kRDhv","6144:1kRDhv0","6144:kRDhv0i","6144:RDhv0ib","6144:Dhv0ibR","6144:hv0ibRQ","6144:v0ibRQn","6144:0ibRQno","6144:ibRQnol","6144:bRQnolV","6144:RQnolVL","6144:QnolVLN"],"imphash":"8db30f7f23140d78d7f34e827c0f7dbd"},"file_info":{"file_name":"jusched.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":528896,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1780716732000,"last_seen":1780725815000,"last_multi_scan":1780725815000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","modular","rat","lazy","loader","backdoor","amadeyloader","informationstealer","stealcv2","amadeystealer","opensource","redlinestealer","xworm","criminal","stealc","asyncrat","downloader"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":70},"sandbox_signatures":{"informative_count":161,"suspicious_count":12,"malicious_count":7,"total":180},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Amadey","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.Amadey","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.108302","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.108302 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/TrojanDownloader.Amadey.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.DOMG.ewhn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Downloader.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/W64.Agent.cr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 005e8d5f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Lumma.tt6a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Trojan-IEM!851002F48A6D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.LXAX-7785","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.GenusT.FRVF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Amadey.Win64.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Doina.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Loads the task scheduler interface DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create local account"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to decompress files using PowerShell"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"Local Groups","attack_id":"T1069.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/001","identifiers":[{"type":"informative","value":"Able to retrieve local groups information"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a web server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000184.00000000.298713.A74E0000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00000588.00000000.307833.935C0000.00000004.mdmp, 00000000-00001388.00000000.305389.47BC0000.00000004.mdmp, 00000000-00003432.00000000.301445.DD370000.00000004.mdmp, 00000000-00003832.00000000.308213.2A440000.00000004.mdmp, 00000000-00004036.00000000.307415.E9130000.00000004.mdmp, 00000000-00006008.00000000.302598.31390000.00000004.mdmp, 00000000-00006696.00000000.304591.3B800000.00000004.mdmp, 00000000-00006748.00000000.301830.4AC50000.00000004.mdmp\")\n Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002472.00000000.297958.F8F10000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000184.00000000.298713.A74E0000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00000952.00000000.304208.280E0000.00000004.mdmp, 00000000-00003588.00000000.306997.09E30000.00000004.mdmp, 00000000-00004036.00000000.307415.E9130000.00000004.mdmp, 00000000-00004332.00000000.301055.25130000.00000004.mdmp, 00000000-00004732.00000000.300277.B1CC0000.00000004.mdmp, 00000000-00006008.00000000.302598.31390000.00000004.mdmp, 00000000-00006748.00000000.301830.4AC50000.00000004.mdmp, 00000000-00007976.00000000.305800.7D650000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002264.00000000.297622.68080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\"\n Found system information discovery API: \"GetSystemInfo\" in file \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve local groups information","description":"Found string \"net localgroup \"Administrators\" \"\" (Indicator: \"net localgroup\"; File: \"de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0.bin\"), Found string \"net localgroup \"Administrators\" \"\" (Indicator: \"net localgroup\"; Source: \"00000000-00000896.00000000.300672.F1B40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.001","relevance":1,"id":"string-526","sources":[{"report_type":"sandbox","report_id":"6a23b836ec8a3c91ec0868a6"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"