25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:T448,Pattern match: "https://pastebin.com/raw/xxxxx", Pattern match: "http://{id:{ok:,payload:{ok:false,error:payload", Pattern match: "http://127.0.0.1:8090", Heuristic match: " leave button as-is */ } } // zig path is configured server-side and not shown to clients. // ===== build ===== document.getelementbyid('btn-build').addeventlistener('click', async () => { const pastebin", Pattern match: "https://fonts.googleapis.com", Pattern match: "screenmod.exe/client/screenmod", Pattern match: "audit.log/agent_ed25519.pub/server_ed25519.key", Pattern match: "s.life/s.max", Pattern match: "https://fonts.googleapis.com/css2?family=pirata+one&family=jetbrains+mono:wght@400;700&display=swap", Pattern match: "g.life/g.max", Heuristic match: " text scrambles then resolves const dch = 'abcdef0123456789$#%&*'; function decryptel(el) { const orig = el.textcontent; if (!orig || orig.length < 4 || el.dataset.dec) return; el.dataset.dec = '1'; ", Pattern match: "panel.settings.json/server/camongodb"27:T2cb4,Observed email domain:"%&*+='; const fs = 13; let cols = []; function initrain(){ cols = []; const n = math.ceil(mw / fs) + 1; for (let i=0;i -999 ? (smx - mw/2) * 0.012 : 0); mx.font = fs + 'px "jetbrains mono", monospace'; mx.textalign = 'center'; for (const c of cols){ c.y += c.spd; if (c.y - c.trail*fs > mh) { c.y = -math.random()*200; c.spd = 0.8+math.random()*3.2; c.trail = 6+(math.random()*14|0); c.glyphs.length = 0; } const dx = c.x + parx; for (let j=c.trail;j>=1;j--){ const ty = c.y - j*fs; if (ty < -fs || ty > mh+fs) con" [Source: sample.bin], Observed email domain:" mouse acts like a lamp over the coins if (smx > -999) { const mg = mx.createradialgradient(smx, smy, 0, smx, smy, 170); mg.addcolorstop(0, 'rgba(255,215,94,0.10)'); mg.addcolorstop(1, 'rgba(255,215,94,0)'); mx.fillstyle = mg; mx.fillrect(smx-170, smy-170, 340, 340); } for (const c of coins){ // mouse repel + spin-up (smoothed cursor) const dx = c.x - smx, dy = c.y - smy; const d2 = dx*dx + dy*dy, r = 150; if (d2 < r*r) { const d = math.sqrt(d2) || 1; const f = (1 - d/r) * 2.4 * c.z; c.vx += (dx/d) * f; c.vy += (dy/d) * f; c.ps = math.min(c.ps + 0.012, 0.16); } c.vx *= 0.94; // dampen push c.vy += (c.bvy - c.vy) * 0.06; // ease back to fall speed " [Source: sample.bin], Observed email domain:"ail mx.fillrect(0, 0, mw, mh); drawrain(); ticksurge(); // drifting nebula blobs for (const b of blobs){ const bx = (b.x + math.sin(t*b.sp + b.ph)*0.07) * mw; const by = (b.y + math.cos(t*b.sp*0.8 + b.ph)*0.06) * mh; const br = b.r * math.min(mw, mh); const bg = mx.createradialgradient(bx, by, 0, bx, by, br); bg.addcolorstop(0, b.c); bg.addcolorstop(1, 'rgba(0,0,0,0)'); mx.fillstyle = bg; mx.fillrect(bx-br, by-br, br*2, br*2); } // cursor light " [Source: sample.bin], Observed email domain:" c.ps += (c.bps - c.ps) * 0.04; // ease back to spin speed c.y += c.vy; c.x += c.vx; c.ph += c.ps; if (c.y - c.r > mh) { for (let k=0;k<3;k++) spawnspark(c.x, mh-8, (math.random()-0.5)*1.6, -(0.4+math.random()*1.4), 55+math.random()*40); spawncoin(c, true); } else if (c.x < -40 || c.x > mw+40) spawncoin(c, true); drawcoin(c); } for (let i=sparks.length-1;i>=0;i--){ const s = sparks[i]; s.life++; s.y += s.vy; s.x += s.vx; const t = 1 - s.life/s.max; if (t <= 0 || s.y < -10) { sparks.splice(i,1); continue; } mx.globalalpha = t*0.8; mx.fillstyle = '#ffe9a8'; mx.beginpath(); mx.arc(s.x, s.y, s.r, 0, math.pi*2); mx.fill(); } mx.globalalpha = 1; tickglints(); drawripples(); if (math.random() < " [Source: sample.bin], Observed email domain:"on glint mx.globalalpha = c.a * 0.9; mx.fillstyle = 'rgba(255,244,200,0.95)'; mx.fillrect(-w, -1, w*2, 2); } // shine streak mx.globalalpha = c.a * 0.55 * sq; mx.strokestyle = 'rgba(255,255,255,0.75)'; mx.beginpath(); mx.moveto(-w*0.5, -c.r*0.5); mx.lineto(w*0.15, -c.r*0.72); mx.stroke(); mx.restore(); } (function draw(){ t++; // lerp smoothed mouse + tilt + shine + reticle " [Source: sample.bin], Observed email domain:" c.vy = c.bvy; c.vx = (math.random()-0.5) * 0.4 * c.z; c.ph = math.random()*math.pi*2; c.bps= 0.015 + math.random()*0.05; // base spin speed c.ps = c.bps; c.a = 0.2 + 0.6*c.z; } for (let i=0;i 46) return; sparks.push({ x:x, y:y, r:0.6+math.random()*1.7, life:0, max: max || (140+math.random()*120), vx: vx!==undefined ? vx : (math.random()-0.5)*0.3, vy: vy!==undefined ? vy : -(0.25+math.random()*0.5) }); } function drawcoin(c){ const sq = math.abs(math.cos(c.ph)); // 3d spin squash const w = math.max(c.r*sq, c.r*0.12); mx.save(); mx.globalalpha = c.a; mx.translate(c.x, c.y); mx.rotate(math.sin(c.ph*0.5)*0.35); // w" [Source: sample.bin], Observed email domain:" smooth but responsive if (mousex > -999) { if (smx < -999) { smx = mousex; smy = mousey; } smx += (mousex - smx) * 0.28; smy += (mousey - smy) * 0.28; } else { smx = -9999; smy = -9999; } cpx += (tpx - cpx) * 0.13; cpy += (tpy - cpy) * 0.13; cmx += (tmx - cmx) * 0.22; cmy += (tmy - cmy) * 0.22; loginboxel.style.setproperty('--px', cpx.tofixed(3)); loginboxel.style.setproperty('--py', cpy.tofixed(3)); loginboxel.style.setproperty('--mx', cmx.tofixed(1) + 'px'); loginboxel.style.setproperty('--my', cmy.tofixed(1) + 'px'); if (mousex > -999) { retx += (mousex - retx) * 0.6; rety += (mousey - rety) * 0.6; if (reticle) { reticle.style.left = retx + 'px'; reticle.style.top = rety + 'px'; reticle.style.opacity = 1; } } else if (reticle) reticle.style.opacity = 0; mx.fillstyle = 'rgba(3,9,20,0.30)'; // motion tr" [Source: sample.bin], Observed email domain:" tiny sparkles twinkling over the field function tickglints(){ if (math.random() < 0.35 && glints.length < 40) glints.push({ x:math.random()*mw, y:math.random()*mh, life:0, max:30+math.random()*40 }); for (let i=glints.length-1;i>=0;i--){ const g = glints[i]; g.life++; const t = g.life/g.max; if (t >= 1) { glints.splice(i,1); continue; } const a = math.sin(t*math.pi) * 0.7; mx.globalalpha = a; mx.strokestyle = '#fff3c4'; mx.linewidth = 1; const r = 2 + t*5; mx.beginpath(); mx.moveto(g.x-r, g.y); mx.lineto(g.x+r, g.y); mx.moveto(g.x, g.y-r); mx.lineto(g.x, g.y+r); mx.stroke(); } mx.globalalpha = 1; } function drawripples(){ for (let i=ripples.length-1;i>=0;i--){ const rp = ripples[i]; rp.r += 10; rp.a -= 0.0" [Source: sample.bin], Observed email domain:"35; if (rp.a <= 0) { ripples.splice(i,1); continue; } for (const c of coins){ const dx = c.x-rp.x, dy = c.y-rp.y, d = math.hypot(dx,dy); if (math.abs(d-rp.r) < 34 && d > 0.1) { const f = rp.a*1.4; c.vx += (dx/d)*f; c.vy += (dy/d)*f; } } mx.strokestyle = 'rgba(255,215,94,' + (rp.a*0.5) + ')'; mx.linewidth = 1.5; mx.shadowcolor = '#ffd75e'; mx.shadowblur = 12; mx.beginpath(); mx.arc(rp.x, rp.y, rp.r, 0, math.pi*2); mx.stroke(); mx.shadowblur = 0; } } function spawncoin(c, top){ c.z = 0.35 + math.random()*0.65; // depth: smaller/slower/dimmer when far c.x = math.random()*mw; c.y = top ? -40 - math.random()*mh*0.4 : math.random()*mh; c.r = (5 + math.random()*11) * c.z; c.bvy= (0.35 + math.random()*1.3) * c.z; // base fall speed " [Source: sample.bin], Observed email domain:"obble while spinning mx.shadowcolor = 'rgba(255,200,60,0.85)'; mx.shadowblur = 16*c.z; const g = mx.createradialgradient(-w*0.35, -c.r*0.35, c.r*0.08, 0, 0, c.r); g.addcolorstop(0, '#fff3c4'); g.addcolorstop(0.45, '#ffd75e'); g.addcolorstop(0.8, '#f0b90b'); g.addcolorstop(1, '#7a5c10'); mx.fillstyle = g; mx.beginpath(); mx.ellipse(0, 0, w, c.r, 0, 0, math.pi*2); mx.fill(); mx.shadowblur = 0; mx.strokestyle = 'rgba(255,240,190,0.9)'; mx.linewidth = 1; mx.beginpath(); mx.ellipse(0, 0, w*0.8, c.r*0.8, 0, 0, math.pi*2); mx.stroke(); if (sq > 0.45) { mx.fillstyle = 'rgba(96,64,0,0.95)'; mx.font = 'bold ' + math.floor(c.r*1.05) + 'px "jetbrains mono"'; mx.textalign = 'center'; mx.textbaseline = 'middle'; mx.filltext('$', 0, 1); } else if (sq < 0.18) { // edge-" [Source: sample.bin], Observed email domain:" smooth but responsive smx += (mouse.x - smx) * 0.28; smy += (mouse.y - smy) * 0.28; cpx += (tpx - cpx) * 0.13; cpy += (tpy - cpy) * 0.13; cmx += (tmx - cmx) * 0.22; cmy += (tmy - cmy) * 0.22; loginboxel.style.setproperty('--px', cpx.tofixed(3)); loginboxel.style.setproperty('--py', cpy.tofixed(3)); loginboxel.style.setproperty('--mx', cmx.tofixed(1) + 'px'); loginboxel.style.setproperty('--my', cmy.tofixed(1) + 'px'); retx += (mouse.x - retx) * 0.6; rety += (mouse.y - rety) * 0.6; if (reticle) { reticle.style.left = retx + 'px'; reticle.style.top = rety + 'px'; } shakex *= 0.88; shakey *= 0.88; ctx.save(); ctx.translate(shakex, shakey); ctx.clearrect(-10, -10, w + 20, h + 20); // card rect refreshes periodically " [Source: sample.bin], Observed email domain:"tinue; if (!c.glyphs[j] || math.random() < 0.02) c.glyphs[j] = glyphs[(math.random()*glyphs.length)|0]; const a = (1 - j/c.trail) * 0.22; if (a < 0.02) continue; mx.fillstyle = 'rgba(255,200,80,' + a + ')'; mx.filltext(c.glyphs[j], dx, ty); } mx.fillstyle = 'rgba(255,230,150,0.5)'; mx.filltext(glyphs[(math.random()*glyphs.length)|0], dx, c.y); } } rsz(); // safe now " [Source: sample.bin]28:T1366,Found reference to API (Indicator: "NtWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtDelayExecution"; Source: "sample.bin"), Found reference to API (Indicator: "NtOpenFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtWaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "NtTerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlAllocateHeap"; Source: "sample.bin"), Found reference to API (Indicator: "NtOpenThread"; Source: "sample.bin"), Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtClose"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RtlQueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "RtlSetCurrentDirectory_U"; Source: "sample.bin"), Found reference to API (Indicator: "RtlQueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "NtResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "LdrUnloadDll"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlFreeHeap"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtAllocateVirtualMemory"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryAttributesFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryVolumeInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "RtlEqualUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateNamedPipeFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "RtlReportSilentProcessExit"; Source: "sample.bin"), Found reference to API (Indicator: "LdrGetProcedureAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RtlEnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "NtFsControlFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtMapViewOfSection"; Source: "sample.bin"), Found reference to API (Indicator: "LdrLoadDll"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetCurrentDirectory_U"; Source: "sample.bin"), Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUpcaseUnicodeChar"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateThreadEx"; Source: "sample.bin"), Found reference to API (Indicator: "NtAlertThread"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryDirectoryFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtFreeVirtualMemory"; Source: "sample.bin"), Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "sample.bin"), Found reference to API (Indicator: "RtlReleaseActivationContext"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetFullPathName_U"; Source: "sample.bin"), Found reference to API (Indicator: "NtSetInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetActiveActivationContext"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlExitUserProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "NtReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "RtlActivateActivationContextEx"; Source: "sample.bin")29:Ta2e,file/memory contains long string with (Indicator: "password"; Source: "sample.bin"), Found string "/api/admin/user_password" (Indicator: "password"; Source: "sample.bin"), Found string "{"ok":false,"error":"Build lock failed"}{"password_hash":"{"approved":{"banned":Kicking agent # " (Indicator: "password"; Source: "sample.bin"), Found string "rio', en: 'User' }, 'common.password': { pt: 'Senha', en: 'Password' }, 'common.credits': { pt: 'Cr" (Indicator: "password"; Source: "sample.bin"), Found string "password/email too long" (Indicator: "password"; Source: "sample.bin"), Found string "

=3, password>=6 required" (Indicator: "password"; Source: "sample.bin"), Found string "password" (Indicator: "password"; Source: "sample.bin"), Found string "a login novamente com a nova senha.' : 'Your password was changed by the administrator. Your session has ended " (Indicator: "password"; Source: "sample.bin"), Found string "rio', en: 'Username' }, 'admin.password': { pt: 'Senha', en: 'Password' }, 'admin.credits': { pt: 'Cr" (Indicator: "password"; Source: "sample.bin"), Found string "reseller.password" (Indicator: "password"; Source: "sample.bin"), Found string "

Access Key =6 required" (Indicator: "password"; Source: "sample.bin"), Found string "{"action":"password"}" (Indicator: "password"; Source: "sample.bin"), Found string "{"reason":"password"}" (Indicator: "password"; Source: "sample.bin"), Found string "/api/admin/reseller_password" (Indicator: "password"; Source: "sample.bin"), Found string "password too long" (Indicator: "password"; Source: "sample.bin"), Found string "user.password" (Indicator: "password"; Source: "sample.bin")2a:T434,Found reference to API " red only === function frameGlitchBurst() { const frame = document.getElementById('glitch-frame'); if (!frame) return; let count = 0; const burst = setInterval(() => { const isBright = Math.random() > 0.5; const color = isBright ? '196,30,58' : '255,0,60'; frame.style.boxShadow = `inset 0 0 0 ${1 + Math.random() * 3}px rgba(${color},${0.4 + Math.random() * 0.4})`; frame.style.transform = `translate(${(Math.random() - 0.5) * 5}px, ${(Math.random() - 0.5) * 5}px)`; count++; if (count > 8) { clearInterval(burst); frame.style.boxShadow = ''; frame.style.transform = ''; } }, 40); } setInterval(() => { if (Math.random() > 0.75) frameGlitchBurst(); }, 2000); // ===== JS-tracked drag (no SendMessage hack, no WebView" (Indicator: "sendmessage"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample e36d66c074a5… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample e36d66c074a5…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/e36d66c074a55c04de9188186f25b81821d17991759bb9f0cd63c2ef6434102d\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"e36d66c074a55c04de9188186f25b81821d17991759bb9f0cd63c2ef6434102d\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"multidesk-server.exe\",\"applicationCategory\":[\"peexe\",\"64bits\",\"executable\"],\"identifier\":\"e36d66c074a55c04de9188186f25b81821d17991759bb9f0cd63c2ef6434102d\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":28},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":1},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L25",null,{"initialData":{"schema_version":"1.0.15","sha256":"e36d66c074a55c04de9188186f25b81821d17991759bb9f0cd63c2ef6434102d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793140397305,"unified_at":"2026-10-27T22:33:17.305Z","metadata":{"hashes":{"sha256":"e36d66c074a55c04de9188186f25b81821d17991759bb9f0cd63c2ef6434102d","sha1":"9b3e14160a9a47ab393cdb3e1ec0579596359106","md5":"c5a88a244c1575ec1f8ba17f98c5cb03"},"file_info":{"file_name":"multidesk-server.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2479104,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793140389000,"last_seen":1793140390000,"last_multi_scan":1793140390000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":35},"sandbox_signatures":{"informative_count":51,"suspicious_count":1,"malicious_count":0,"total":52},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to lock or unlock file/device object (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Able to compress file/directory using PowerShell cmdlet"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Contains ability to access the loader directly (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://pastebin.com\", Found HTTPS url \"https://fonts.googleapis.com\", Found HTTPS url \"https://fonts.gstatic.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\nContent-Type: multipart/x-mixed-replace; boundary=jpegframe\nCache-Control: no-cache\nConnection: keep-alive\nX-Accel-Buffering: no\n\n\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"HTTP/1.1 200 OK\nContent-Type: text/event-stream\nCache-Control: no-cache\nConnection: keep-alive\nX-Accel-Buffering: no\n\n\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"file/memory contains long string with (Indicator: \"\"ping\"; Source: \"sample.bin\"), Found string \" user/license features disabled\nMongoDB connected\n{\"ping\":1}\" (Indicator: \"\"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \" Bearer tokens and cookies\nSOAK MODE: agent port (production port 6166 blocked, source=SOAK MODE: refusing to bind production agent port 6166 \" (Indicator: \" bind \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:8090\", \"127.0.0.1\", \"0.0.0.0\", Potential IP \"127.0.0.1\" found in string \"mongodb://127.0.0.1:27017\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \".googleapis.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"NtTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"X\\Device\\Afd\\Endpoint\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"\\Device\\\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"\\Device\\CNG\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"\\drivers\\etc\\hosts\" (Indicator: \"\\drivers\\\"; Source: \"sample.bin\"), Found string \"\\DosDevices\\\" (Indicator: \"\\DosDevices\\\"; Source: \"sample.bin\"), Found string \"h\\Device\\Null\\Device\\NamedPipe\\\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to lock or unlock file/device object (API string)","description":"Found reference to API \"NtUnlockFile\" (Indicator: \"NtUnlockFile\"; Source: \"sample.bin\"), Found reference to API \"NtLockFile\" (Indicator: \"NtLockFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-473","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"sample.bin\"), Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"sample.bin\"), Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"NtOpenThread\" (Indicator: \"OpenThread\"; Source: \"sample.bin\"), Found reference to API \"NtResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"NtCreateThreadEx\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"sample.bin\"), Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\"), Found reference to API \"NtFsControlFile\" (Indicator: \"FsControlFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Compress-Archive\"; Source: \"sample.bin\"), Found string \" Compress-Archive on the agent \" (Indicator: \"Compress-Archive\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"NtDelayExecution\" (Indicator: \"NtDelayExecution\"; Source: \"sample.bin\"), Found reference to API \"NtWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"NtWaitForSingleObject\" (Indicator: \"NtWaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"RtlQueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"RtlQueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"NtOpenThread\" (Indicator: \"OpenThread\"; Source: \"sample.bin\"), Found reference to API \"NtResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"NtAllocateVirtualMemory\" (Indicator: \"AllocateVirtualMemory\"; Source: \"sample.bin\"), Found reference to API \"NtMapViewOfSection\" (Indicator: \"NtMapViewOfSection\"; Source: \"sample.bin\"), Found reference to API \"NtCreateThreadEx\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1132","id":"string-338","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"NtCreateThreadEx\" (Indicator: \"NtCreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-79","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.012","id":"string-90","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ConvertTo-Json\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1565","id":"string-366","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"hostname\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"const AES_NONCE_ENC = [_]u8{ 0x12 ^ 0x4D, 0x34 ^ 0xC2, 0x56 ^ 0x9A, 0x78 ^ 0x3F, 0x9a ^ 0xB1, 0xbc ^ 0x7E, 0xde ^ 0x58, 0xf0 ^ 0xE0, 0x11 ^ 0x23, 0x22 ^ 0x6B, 0x33 ^ 0x14, 0x44 ^ 0xD9 };\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"const AES_KEY_ENC = [_]u8{\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"const AES_NONCE_MASK = [_]u8{ 0x4D, 0xC2, 0x9A, 0x3F, 0xB1, 0x7E, 0x58, 0xE0, 0x23, 0x6B, 0x14, 0xD9 };\" (Indicator: \"aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"const AES_NONCE_ENC = [_]u8{\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \" 0xconst max_backoff_ms: u64 = obf.stackStr(\"\")const PASTEBIN_URL_KEY = const AES_NONCE_MASK = const AES_KEY_MASK = ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$29","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"NtQueryInformationFile\" (Indicator: \"QueryInformationFile\"; Source: \"sample.bin\"), Found reference to API \"NtQueryAttributesFile\" (Indicator: \"QueryAttributesFile\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"RtlGetCurrentDirectory_U\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-478","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\"), Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\"), Found reference to API \"NtQueryObject\" (Indicator: \"NtQueryObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"NtQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-ChildItem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-394","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Select-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-374","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"Found string \"--host\" (Indicator: \"--host\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1219","id":"string-883","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"RtlQueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-162","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-907","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"NtQuerySystemInformation\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-659","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to access the loader directly (API string)","description":"Found reference to API \"LdrLoadDll\" (Indicator: \"LdrLoadDll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1129","id":"string-548","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to compress file/directory using PowerShell cmdlet","description":"file/memory contains long string(Source: \"sample.bin\"), Found string \" Compress-Archive on the agent \" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1560","id":"string-656","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample e36d66c074a5… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample e36d66c074a5…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e36d66c074a55c04de9188186f25b81821d17991759bb9f0cd63c2ef6434102d"}],["$","meta","4",{"property":"og:title","content":"Sample e36d66c074a5… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample e36d66c074a5…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e36d66c074a55c04de9188186f25b81821d17991759bb9f0cd63c2ef6434102d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample e36d66c074a5… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample e36d66c074a5…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]