26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.MSILZilla Sample ee1e4d3e39e4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ee1e4d3e39e4…. Malware family: IL:Trojan.MSILZilla. Threat score 100/100. 12/27 AV engines flagged this file. 9 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5","keywords":["Malicious","IL:Trojan.MSILZilla","malware analysis","sandbox report","threat intelligence","ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5"],"about":{"@type":"SoftwareApplication","name":"ratonClient.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.MSILZilla","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6ae," H.textp `.rsrcP@"@@.reloc`&@BL?H '0rp( ( ( ,( o ( ,( %-&+o ( ,rp( s z4%%rp%%rp%o ( s z*cc4( *0b-~o &~o ~~( (+~ %-&~Ds % (+(+s *0%rp%rp%rp%r%p%r+p%r1p%r7p -r=p(! *(" %l#@(# ($ (% l#@l(& [(' (( lZ () (! *04s* + rAp(+ o, &Xi2o- *0%(. io/ ( ,o0 * 0%(1 io/ ( ,o0 * 0%(2 io/ ( ,o0 * (3 *rGpr}ps4 s4 *{*"}*J(3 s5 (&*b(%(6 o7 o8 *N(%(9 o8 *N(%(: o8 *N(%(; o8 *0 o? (@ ,o0 **0 :(%o8 *{*"}*(3 *{*"}*0A(?s@ s= %soA oB t ,o0 o.(2** ^(1, (1oC **b(4-*(1oD *(4-*(6 (1oD oE *z(4-*(1oD (F *z(4-*(1oD (G *z(4-*(1oD (H *~(4-j*(1oD (I *(4- #*(1oD (J *"(5*(1*(3 *0X s@ %oK &(H sL % oK & , o0 ,o0 *(A DK 0R s< i(9 oM sL ioM oN ,o0 o? ,o0 * 3 @F (3 *.sC*(3 *^~oO oP oQ *BSJBv4.0.30319l#~p#Strings#US#GUID@#BlobW 3- D#Q LUtqqqlq8qQqq`hqTP\14; >"*qT\M*3T h>p=IsI% I.xI1I?!IB0 0 0 6lIk I 2I I U tI ?I &I y i ! I I 1I [I I P #!@!*!/0"4p"4"4"4 <#@ D#F: n#> v#H #@#S#W$H`$@h$>p$H|$k$Mr$0 % 0%rO%^wn%|%)%%0 %>!%@!%!p&"&@#&F:#'@#' #lC}} @@@ )@1@9@A@I@Q@Y@a@i@q@@#*b08=+C@xIM@Sy@Z I `@y@Q;:,U!!I@)NI1J9@@@Ac*A06I>IDIJ@Q@YW_@kYqYw~AIITI,IHIa&@aaVa....#.+.3.;.C.K.S.[.c.ks9s9s9#s9s9s9s9s9 s9@s9Pd6YxC*}m%)5_# !#%')+-/13%5&5.7/71929r" 9n=?<>9__4_0b__4_0SHA1IEnumerable`1ToInt32Func`2Dictionary`2ToInt64MD5ToInt16SHA256get_UTF8<>9get_UACget_UIDSHA1_STRINGMD5_STRINGSHA256_STRINGget_VMSystem.IOINTEGERPackedDatadataMessagePackLibmscorlib<>cPaccUnpaccSystem.Collections.Genericget_HidProcReadLoadk__BackingFieldSendAppendRoundget_PasswordCompressionModeget_MessageIClientBridgeEnumerableIDisposableToDoubleGetAsDoubleget_HideFiletypeNameassemblyNameBindToTypeGetTypeSystem.CoreDisposeCreateWriteget_Websiteget_OpenWebsiteCompilerGeneratedAttributeDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeBytevalueSerializeDeserializePacketStuffget_TagEncodingSystem.Runtime.VersioningBytesToStringGetAsStringGetStringSetStringGetAsLongSetLongLogget_BoxMsgComputeHashFlushMathget_LengthlengthPackUnpackget_ProcessCriticalGetAllMessagePackLib.dllGetAsBoolSetBoolGZipStreamMemoryStreamget_Itemset_ItemSystemHashAlgorithmlengthRandomcharsRandomToBooleanSignget_BoxIconget_VersionSystem.IO.CompressionSystem.Runtime.SerializationSystem.ReflectionSerializationExceptionZipget_StartupSystem.LinqStringBuilderget_Defenderset_BinderCustomBinderSerializationBinderGetAsIntegerToUpperBitConverterIFormatterBinaryFormatterFloor.ctor.cctorHasAbsSystem.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesDebuggingModesGetBytesbytesget_CharsHelpersCompressDecompressget_Objectsset_ObjectsConcatRepeatObjectSelectget_ReconnectSetget_BoxTitSetIntbyteCountConvertget_PortGetAsShortget_Assistget_HostinputNextSystem.Textget_RawGetRawPowConvertToHexget_Mutexget_Boxget_UACByget_DelayGetAsByteArrayToArrayContainsKeykeySystem.Security.CryptographyGetExecutingAssemblySystem.Runtime.Serialization.Formatters.Binaryop_Equality in BKBMBGBTBPBEB0x25abcdefghijklmnopqrstuvwxyz0123456789ϴOUnE AAEAAAy Ay E e e Q QUU YY]]i m m = mq mq z\V4Mi$e A i i ((( (iTWrapNonExceptionThrows1.0.0.0G.NETFramework Version=v4.0TFrameworkDisplayName.NET Framework 4@?Z? L?_CorDllMainmscoree.dll% 0HX@4VS_VERSION_INFO?DVarFileInfo$TranslationTStringFileInfo0000004b0Comments"CompanyName*FileDescription0FileVersion1.0.0.0FInternalNameMessagePackLib.dll&LegalCopyright*LegalTrademarksNOriginalFilenameMessagePackLib.dll"ProductName4ProductVersion1.0.0.08Assembly Version1.0.0.00l?"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791137955202,"unified_at":"2026-10-04T18:19:15.202Z","metadata":{"hashes":{"sha256":"ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5","sha1":"868c67c34c890e038e1ba06ba6bd5cce7c59360b","md5":"4e5636a99d96a3738fe5496b7a625142","sha512":"2ce4d57a43c8006ecda8ef1a9115643a99dc7d50c4b6595e8ae76b82dc2f19e815259c47d7857295f1944b83ebeb2ecdac686ccbd45ebca17187574669a33611","ssdeep":"1536:IC0lB4H00wz0epKV1Tsqa4tsi5lRjTnwCbTtlbe4CUBoJWs3:IxlB4HWzPC1AX4tndnwCbTtlbezUB6WW","ssdeep_chunks":["1536:IC0lB4H","1536:C0lB4H0","1536:0lB4H00","1536:lB4H00w","1536:B4H00wz","1536:4H00wz0","1536:H00wz0e","1536:00wz0ep","1536:0wz0epK","1536:wz0epKV","1536:z0epKV1","1536:0epKV1T","1536:epKV1Ts","1536:pKV1Tsq","1536:KV1Tsqa","1536:V1Tsqa4","1536:1Tsqa4t","1536:Tsqa4ts","1536:sqa4tsi","1536:qa4tsi5","1536:a4tsi5l","1536:4tsi5lR","1536:tsi5lRj","1536:si5lRjT","1536:i5lRjTn","1536:5lRjTnw","1536:lRjTnwC","1536:RjTnwCb","1536:jTnwCbT","1536:TnwCbTt","1536:nwCbTtl","1536:wCbTtlb","1536:CbTtlbe","1536:bTtlbe4","1536:Ttlbe4C","1536:tlbe4CU","1536:lbe4CUB","1536:be4CUBo","1536:e4CUBoJ","1536:4CUBoJW","1536:CUBoJWs","1536:UBoJWs3","3072:IC0lB4H","3072:C0lB4H0","3072:0lB4H00","3072:lB4H00w","3072:B4H00wz","3072:4H00wz0","3072:H00wz0e","3072:00wz0ep","3072:0wz0epK","3072:wz0epKV","3072:z0epKV1","3072:0epKV1T","3072:epKV1Ts","3072:pKV1Tsq","3072:KV1Tsqa","3072:V1Tsqa4","3072:1Tsqa4t","3072:Tsqa4ts","3072:sqa4tsi","3072:qa4tsi5","3072:a4tsi5l","3072:4tsi5lR","3072:tsi5lRj","3072:si5lRjT","3072:i5lRjTn","3072:5lRjTnw","3072:lRjTnwC","3072:RjTnwCb","3072:jTnwCbT","3072:TnwCbTt","3072:nwCbTtl","3072:wCbTtlb","3072:CbTtlbe","3072:bTtlbe4","3072:Ttlbe4C","3072:tlbe4CU","3072:lbe4CUB","3072:be4CUBo","3072:e4CUBoJ","3072:4CUBoJW","3072:CUBoJWs","3072:UBoJWs3","1536:IxlB4HW","1536:xlB4HWz","1536:lB4HWzP","1536:B4HWzPC","1536:4HWzPC1","1536:HWzPC1A","1536:WzPC1AX","1536:zPC1AX4","1536:PC1AX4t","1536:C1AX4tn","1536:1AX4tnd","1536:AX4tndn","1536:X4tndnw","1536:4tndnwC","1536:tndnwCb","1536:ndnwCbT","1536:dnwCbTt","1536:bTtlbez","1536:TtlbezU","1536:tlbezUB","1536:lbezUB6","1536:bezUB6W","1536:ezUB6WW"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"ratonClient.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":87040,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1771758043000,"last_seen":1771758572000,"last_multi_scan":1771758572000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","silverrat","modular","rat","crypt","njrat","gandcrypt","quasar","opensource","targeted","xworm","criminal","asyncrat","downloader","malicious"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":49},"sandbox_signatures":{"informative_count":109,"suspicious_count":8,"malicious_count":9,"total":126},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Adware/Win.Cerbu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Exploit]/MSIL.BypassUAC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"EXP/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.240241","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.MSILZilla.240241 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.FQI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan/Agent.ai","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/MSIL-TKP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_56.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.MSILZilla","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Able to execute application (.NET)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"malicious","value":"Script loads executable in memory (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to load manifest resource from assembly (Dotnet)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to perform crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Contains ability to block user input (API string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Able to load content into memory (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve user privileges"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Opens a handle to the specified local process"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5.bin\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5.bin\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\" nul\" (Indicator: \"chcp\"; File: \"ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007484-00000C2C-2200745508\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007484-00000C2C-2202361401\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: ee1e4d3e39e4c7232021b0e3ed8004489ff56e8f80945c14b956bbbffadca7a5.bin\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00007484-00000C2C-2207574325","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"699ae3eb768b729e070ebdb2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"