24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample e2c3ef4c8c11… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e2c3ef4c8c11…. Malware family: Mint.Zard.Generic. Threat score 100/100. 14/26 AV engines flagged this file. 5 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e2c3ef4c8c11ffbeef78009833dde5c44b343ffdf1b314e5f85a3dc270a6e264","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","e2c3ef4c8c11ffbeef78009833dde5c44b343ffdf1b314e5f85a3dc270a6e264"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"e2c3ef4c8c11ffbeef78009833dde5c44b343ffdf1b314e5f85a3dc270a6e264","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":14,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T536,Contains base64 string in header "like" in header "GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com" Contains base64 string in header "4664" in header "GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com" Contains base64 string in header "like" in header "GET /okkk/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162" Contains base64 string in header "4664" in header "GET /okkk/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162" Contains base64 string in header "like" in header "GET /okkk/22938.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162" Contains base64 string in header "4664" in header "GET /okkk/22938.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 158.94.211.162"26:T775," HTTP/1.1 200 OK Date: Sat 28 Mar 2026 13:23:19 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=5K90DrFKUEIGiQlBX2X_3EnnJOzaYifWPUMMF4FSgXM-1774704199.3111978-1.0.1.1-cqAW1J_lVwT5pc8yVjD0nGAmQrg7P4KZ6Gzv0TrA4SSa0GUUQRE8FgS8RIAhCSiPHXGaHOqgW1bThtpUIy5YyTkLQUIrEUgJ45CB5ggRzCVFaqA6qpFlvYnLQFtzu3AM; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Sat 28 Mar 2026 13:53:19 GMT Server: cloudflare CF-RAY: 9e36f2ddbcffcf8b-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /okkk/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 28 Mar 2026 13:23:20 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sat 28 Mar 2026 13:14:50 GMT Connection: keep-alive ETag: "69c7d44a-6" Accept-Ranges: bytes with response body ==>33363638340A....... "GET /okkk/22938.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 158.94.211.162" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat 28 Mar 2026 13:23:20 GMT Content-Type: text/plain Content-Length: 258495 Last-Modified: Sat 28 Mar 2026 02:02:58 GMT Connection: keep-alive ETag: "69c736d2-3f1bf" Accept-Ranges: bytes with response body ==>6D6F746F406F636E2E6E652E6A703A546F6D6F3139383121210A68656C656E6530406F6E65742E706C3A616D657269636F2E63617272656972610A62616B6572.......2c:T725,"mymail.kmw.co.kr" Heuristic match: "omta5.am0.yahoodns.net" Heuristic match: "up-com.mail.protection.outlook.com" Heuristic match: "5mx3.vodafonemail.de" Heuristic match: "!mx02.mail.icloud.com" Heuristic match: "mx-ttc.eco-mx.cz" Heuristic match: "-mx02.p.bluenet.ch" Heuristic match: "!=etb-3.mail.tiscali.it" Heuristic match: "}hjmx-eu.mail.am0.yahoodns.net" Heuristic match: "ion.outlook.com" Heuristic match: "dmx-att.mail.am0.yahoodns.net" Heuristic match: "l.com" Heuristic match: "`\mx-aol.mail.gm0.yahoodns.net" Heuristic match: "dmx1.naver.com" Heuristic match: "^mta7.am0.yahoodns.net" Heuristic match: "protection.outlook.com" Heuristic match: "smx.abv.bg" Heuristic match: "motorgroup-com.mail.protection.outlook.com" Heuristic match: "4ed$benfieldmotorgroup-com.mail.protection.outlook.com" Heuristic match: "vmx-aol.mail.gm0.yahoodns.net" Heuristic match: "hmx01.t-online.de" Heuristic match: "tlook.co" Heuristic match: "il.protection.outlook.com" Heuristic match: "seci-es.mail.protection.outlook.com" Heuristic match: "y.net" Heuristic match: "x1.nate.com" Heuristic match: "x2c1.comcast.net" Heuristic match: "x1a1.comcast.net" Heuristic match: "x2h1.comcast.net" Heuristic match: "x1c1.comcast.net" Heuristic match: "ealthcentral.com" Heuristic match: "x1h1.comcast.net" Heuristic match: "hatters-ca.mail.protection.outlook.com" Heuristic match: "ealthcentral-com.mail.protection.outlook.com" Heuristic match: "ne.de" Heuristic match: "r.net" Heuristic match: "x02.mxmail.netease.com" Heuristic match: "ap.fastly.net" Heuristic match: "x2.googlemail.com" Heuristic match: "x.generic-isp.com" Heuristic match: "mtp-in.virgilio.it" Heuristic match: "org.mail.pro" Heuristic match: "ok.com" Heuristic match: "x.interia.pl" Heuristic match: "xtmail.bigpond.com" Heuristic match: "hatters.ca" Heuristic match: "eznam.cz" Heuristic match: "x-dfw.smtp.directrouter.com" Heuristic match: "x1.mxge.comcast.net" Heuristic match: "x2.mxge.comcast.net" Heuristic match: "iajeseci-es.mail.protection.outlook.com" Heuristic match: "407be7ee4e82eb6c4d548a93d7a60.pamx1.hotmail.com" Heuristic match: "tice.prod.cloud.openwave.ai" Heuristic match: "elay90.rai.it" Heuristic match: "t.net" Heuristic match: "mx2.mxge.comcast.net" Heuristic match: "mx1.mxge.comcast.net" Heuristic match: "ction.outlook.com" Heuristic match: "}mx.generic-isp.com" Heuristic match: "ja@mx.interia.pl" Heuristic match: "reply.s13.exacttarget.com" Heuristic match: "?omail.pisem.net" Heuristic match: "mkm*mx2.seznam.cz" Heuristic match: "mx.tp" Heuristic match: "mx2h1.comcast.net" Heuristic match: "dptpa-postmx01.email.rr.com" Heuristic match: "eply.s13.exacttarget.com" Heuristic match: "u-smtp-inbound-1.mimecast.com" Heuristic match: "0.yahoodns.nett.com" Heuristic match: "settings-promcast.net" Heuristic match: "ail.ligcorp.com" Heuristic match: "ortal3i.visa.com" Heuristic match: "}himx-eu.mail.am0.yahoodns.net" Heuristic match: "yportal3i.visa.com" Heuristic match: "sn-com.olc.protection.outlook.com" Heuristic match: "k.com" Heuristic match: "mx-10.au-east.atmailcloud.com" Heuristic match: "xb-003c1301.gslb.pphosted.com" Heuristic match: "wu-b-nst.net" Heuristic match: "x-20.au-east.atmailcloud.com" Heuristic match: "x1.pub.mailpod8-cph3.one.com" Heuristic match: "xjp1.nospamcloud.com" Heuristic match: "ust28976-2.in.mailcontrol.com" Heuristic match: "xa-0024a201.gslb.pphosted.com" Heuristic match: "po9.mail.dk" Heuristic match: "x03.t-online.de" Heuristic match: "ayuri-office.jp" Heuristic match: "mx.freemail.hu" Heuristic match: "x0.charter.net" Heuristic match: "ger.net" Heuristic match: "mx05.au.com" Heuristic match: "mx31.au.com" Heuristic match: "mx41.au.com" Heuristic match: "mx21.au.com" Heuristic match: "mx14.au.com" Heuristic match: "mx42.au.com" Heuristic match: "mx44.au.com" Heuristic match: "mx12.au.com" Heuristic match: "mx22.au.com" Heuristic match: "mx43.au.com" Heuristic match: "mx23.au.com" Heuristic match: "csd1-us.mx1.arsmtp.com" Heuristic match: "gmgate1.biglobe.ne.jp" Heuristic match: "p-tel-net.mx.av-mx.com" Heuristic match: "x01.windstream.net" Heuristic match: "mtp-in2.orange.fr" Heuristic match: "penwave.ai" Heuristic match: "mx2.it.soas.ac.uk" Heuristic match: "sls.m.cn" Heuristic match: "manager.net" Heuristic match: "3mx02.mxmail.netease.com" Heuristic match: "relay60.rai.it" Heuristic match: "relay80.rai.it" Heuristic match: "relay30.rai.it" Heuristic match: "relay40.rai.it" Heuristic match: "relay.rai.it" Heuristic match: "x.serveriai.lt" Heuristic match: "x-ha.skymail.net.br" Heuristic match: "reemail.hu" Heuristic match: "x5.wp.pl" Heuristic match: "ebaominh.com.vn" Heuristic match: "harter.net" Heuristic match: "iglobe.jp" Heuristic match: "afelite-com.mail.protection.outlook.com" Heuristic match: "x.rediffmail.rediff.akadns.net" Heuristic match: "on.outlook.com" Heuristic match: "gmgate2.biglobe.ne.jp" Heuristic match: "us-gov-on-ca.mail.protection.outlook.com" Heuristic match: "exhurst-co-uk.mail.protection.outlook.com" Heuristic match: "com.olc.protection.outlook.com" Heuristic match: "ortugaltravelteam-pt02b.mail.protection.outlook.com" Heuristic match: "tn-com-af.mail.protection.outlook.com" Heuristic match: "reemx1.sinamail.sina.com.cn" Heuristic match: "x.bt.prod.cloud.openwave.ai" Heuristic match: "x1.hc49497.c3s2.iphmx.com" Heuristic match: "oogle.com" Heuristic match: "200842b.ess.barracudanetworks.com" Heuristic match: "144884a.ess.barracudanetworks.com" Heuristic match: "139996a.ess.barracudanetworks.com" Heuristic match: "x.altice.prod.cloud.openwave.ai" Heuristic match: "ive-com.olc.protection.outlook.com" Heuristic match: "tease.com" Heuristic match: "mcast.net" Heuristic match: "a1.comcast.net" Heuristic match: "ta-189.21cn.com" Heuristic match: "x1.it.soas.ac.uk" Heuristic match: "nager.net" Heuristic match: "dns.net" Heuristic match: "ol.mail.gm0.yahoodns.net" Heuristic match: "loud.openwave.ai" Heuristic match: "j126mx03.mxmail.netease.com" Heuristic match: "fmx1.pub.mailpod8-cph3.one.com" Heuristic match: "dmxjp1.nospamcloud.com" Heuristic match: "\mxa-0024a201.gslb.pphosted.com" Heuristic match: "l9fpo9.mail.dk" Heuristic match: "'mx1.it.soas.ac.uk" Heuristic match: "ssmtp-in2.orange.fr" Heuristic match: "ibmx01.windstream.net" Heuristic match: "+afmx.freemail.hu" Heuristic match: "'mx.freenet.de" Heuristic match: "jmta7.am0.yahoodns.net" Heuristic match: "ufreemx1.sinamail.sina.com.cn" Heuristic match: "`]mx-aol.mail.gm0.yahoodns.net" Heuristic match: "3mx2.hanmail.net" Heuristic match: ".protection.outlook.com" Heuristic match: "otection.outlook.com" Heuristic match: "bgmgate9.biglobe.ne.jp"35:T6c1,Found URL "http://icanhazip.com/icanhazip.combout:blankummy://urlbout:blankpmapperpmapperpmapperokkk/n.txt163mx02.mxmail.netease.comhttp://158.94.211.162/okkk/22938.txt158.94.211.162/okkk/22938.txtcanhazip.comom.icanhazipws\appdata\local\microsoft\windows\inetcacheookie:\hapubws\appdata\local\microsoft\windows\inetcookiesontentsers\hapubws\appdata\local\microsoft\windows\inetcachec:\users\hapubws\appdata\local\microsoft\windowsinetcookies:\users\hapubws\appdata\local\microsoft\windows\inetcookies:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\:\users\hapubws\appdata\local\microsoft\windows\inetcookies\:\users\hapubws\appdata\local\microsoft\windows\inetcache\ieontent\hapubws\appdata\local\microsoft\windows\historyisited:ookies\hapubws\appdata\local\microsoft\windows\inetcookiescanhazip.com:\users\hapubws\appdata\local\microsoft\feeds" - Source: "00000000-00007040.00000000.267021.02C50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007040.00000000.267021.02C50000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007040.00000001.268941.02C50000.00000004.mdmp") Found URL "http://icanhazip.com/[%s][0.0.0.0][0.0.0.0]%s.comesmtpehlo" - Source: "00000000-00007040.00000002.270863.00154000.00000002.mdmp") Found URL "http://binance.com" - Source: "00000000-00007040.00000002.270863.00154000.00000002.mdmp") Found URL "http://bitrefill.com" - Source: "00000000-00007040.00000002.270863.00154000.00000002.mdmp") Found URL "http://crypto.com" - Source: "00000000-00007040.00000002.270863.00154000.00000002.mdmp") Found URL "http://kucoin.com" - Source: "00000000-00007040.00000002.270863.00154000.00000002.mdmp")36:T654,Contacted domain: "126mx03.mxmail.netease.com" has high entropy Contacted domain: "163mx02.mxmail.netease.com" has high entropy Contacted domain: "194019900.pamx1.hotmail.com" has high entropy Contacted domain: "2019102901.pamx1.hotmail.com" has high entropy Contacted domain: "3407be7ee4e82eb6c4d548a93d7a60.pamx1.hotmail.com" has high entropy Contacted domain: "ALT3.ASPMX.L.GOOGLE.COM" has high entropy Contacted domain: "SpamFilter.rm.cnr.it" has high entropy Contacted domain: "acad.charqueadas.ifsul.edu.br" has high entropy Contacted domain: "alt1.aspmx.l.google.com" has high entropy Contacted domain: "alt2.aspmx.l.google.com" has high entropy Contacted domain: "aspmx2.googlemail.com" has high entropy Contacted domain: "aspmx3.googlemail.com" has high entropy Contacted domain: "aspmx5.googlemail.com" has high entropy Contacted domain: "au-smtp-inbound-1.mimecast.com" has high entropy Contacted domain: "au-smtp-inbound-2.mimecast.com" has high entropy Contacted domain: "beaumes-de-venise.com" has high entropy Contacted domain: "beaumesdevenise-com01ie.mail.protection.outlook.com" has high entropy Contacted domain: "benfieldmotorgroup.com" has high entropy Contacted domain: "bgmgate1.biglobe.ne.jp" has high entropy Contacted domain: "bgmgate2.biglobe.ne.jp" has high entropy Contacted domain: "blueyonder.co.uk" has high entropy Contacted domain: "btopenworld.com" has high entropy Contacted domain: "cdptpa-postmx01.email.rr.com" has high entropy Contacted domain: "centralcoastmedicalgroup.com" has high entropy Contacted domain: "centrum-cz-20mx1.eco-mx.cz" has high entropy37:Tac3,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp, 00000000-00007040.00000002.270863.02C50000.00000004.mdmp, 00000000-00007040.00000003.276368.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp, 00000000-00007040.00000002.270863.02C50000.00000004.mdmp, 00000000-00007040.00000003.276368.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp, 00000000-00007040.00000002.270863.02C50000.00000004.mdmp, 00000000-00007040.00000003.276368.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp, 00000000-00007040.00000002.270863.02C50000.00000004.mdmp, 00000000-00007040.00000003.276368.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp, 00000000-00007040.00000002.270863.02C50000.00000004.mdmp, 00000000-00007040.00000003.276368.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp, 00000000-00007040.00000002.270863.02C50000.00000004.mdmp, 00000000-00007040.00000003.276368.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp, 00000000-00007040.00000002.270863.02C50000.00000004.mdmp, 00000000-00007040.00000003.276368.02C50000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp, 00000000-00007040.00000002.270863.02C50000.00000004.mdmp, 00000000-00007040.00000003.276368.02C50000.00000004.mdmp")38:T9e1,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp, 00000000-00007040.00000002.270863.02C50000.00000004.mdmp, 00000000-00007040.00000003.276368.02C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp, 00000000-00007040.00000002.270863.02C50000.00000004.mdmp, 00000000-00007040.00000003.276368.02C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"@gmail.\"; File: \"e2c3ef4c8c11ffbeef78009833dde5c44b343ffdf1b314e5f85a3dc270a6e264.bin\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$33","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"0.0.0.0\" found in string \"[0.0.0.0]\"\n \"64.124.12.162\"\n \"158.94.211.162\"\n Potential IP \"158.94.211.162\" found in string \"ttp://158.94.211.162/\"\n Potential IP \"158.94.211.162\" found in string \"http://158.94.211.162/okkk/22938.txt\"\n \"58.94.211.162\"\n Potential IP \"158.94.211.162\" found in string \"ttp://158.94.211.162/okkk/n.txt\"\n Potential IP \"158.94.211.162\" found in string \"ttp://158.94.211.162/okkk/22938.txt\"\n Potential IP \"158.94.211.162\" found in string \"http://158.94.211.162/\"\n Potential IP \"158.94.211.162\" found in string \"http://158.94.211.162/okkk/n.txt\"\n Potential IP \"1.0.1.1\" found in string \"5K90DrFKUEIGiQlBX2X_3EnnJOzaYifWPUMMF4FSgXM-1774704199.3111978-1.0.1.1-cqAW1J_lVwT5pc8yVjD0nGAmQrg7P4KZ6Gzv0TrA4SSa0GUUQRE8FgS8RIAhCSiPHXGaHOqgW1bThtpUIy5YyTkLQUIrEUgJ45CB5ggRzCVFaqA6qpFlvYnLQFtzu3AM\"\n Potential IP \"58.94.211.162\" found in string \"58.94.211.162/okkk/n.txt\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$35","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007040.00000000.267021.02C50000.00000004.mdmp, 00000000-00007040.00000001.268941.02C50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: icanhazip.com\n\n GET /okkk/n.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: 158.94.211.162\n\n GET /okkk/22938.txt HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\nHost: 158.94.211.162\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"$36","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"Found string \"gcloud.com\" (Indicator: \"gcloud\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69c7d62878473323f003f0dd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"