21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f22db650cc49… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f22db650cc49…. Malware family: Trojan.Generic. Threat score 100/100. 14/26 AV engines flagged this file. 4 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29"],"about":{"@type":"SoftwareApplication","name":"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T84d,"rted for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonescasfrom_Gscanstatus:top gp->status is not in scan stategentraceback callback cannot be used with non-zero skipmheap.freeSpanLocked - invalid free of user arena chunkos: invalid use of WriteAt on file opened with O_APPENDreflect: internal error: invalid use of makeMethodValuefailed to allocate aligned heap memory; too many retriesin gcMark expecting to see gcphase as _GCmarkterminationnon-empty pointer map passed for non-pointer-size valuesprofilealloc called without a P or outside bootstrappingstrings: illegal use of non-zero Builder copied by value (set GODEBUG=execwait=2 to capture stacks for debugging)cannot run executable found relative to current directorygentraceback cannot trace user goroutine on its own stackruntime: checkmarks found unexpected unmarked object obj=GODEBUG=execwait=2 detected a leaked exec.Cmd created by:reflect: reflect.Value.Elem on an invalid notinheap pointeraddr range base and limit are not in" in Source: f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin "is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonescasfrom_Gscanstatus:top gp->status is not in scan stategentraceback callback cannot be used with non-zero skipmheap.freeSpanLocked - invalid free of user arena chunkos: invalid use of WriteAt on file opened with O_APPENDreflect: internal error: invalid use of makeMethodValuefailed to allocate aligned heap memory; too many retriesin gcMark expecting to see gcphase as _GCmarkterminationnon-empty pointer map passed for non-pointer-size valuesprofilealloc called without a P or outside bootstrappingstrings: illegal use of non-zero Builder copied by value (set GODEBUG=execwait=2 to capture stacks for debugging)cannot run executable found relative to current directorygentraceback cannot trace user goroutine on its own stackruntime: checkmarks found unexpected unmarked object obj=GODEBUG=execwait=2 detected a leaked exec.Cmd created by:" in Source: 00000000-00007660.00000000.259890.00D5E000.00000002.mdmp23:T1534,Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 82950; code bytes = 30d0 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1737977; code bytes = 30d0 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1772868; code bytes = 30d0 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1813550; code bytes = 30d0 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 421865; code bytes = 33c1 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1548436; code bytes = 33c1 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1744729; code bytes = 33c1 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1760871; code bytes = 33c1 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 91600; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 114164; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 242714; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 262063; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 262221; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 310093; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 363030; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 363750; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 364406; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 375365; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 889892; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1419440; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1438584; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1756799; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1782011; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1794058; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1804763; code bytes = 8030 Found XOR loop in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe" at offset 1818202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 82950; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1737977; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1772868; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1813550; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 421865; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1548436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1760871; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 91600; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 114164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 242714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 262063; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 262221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 310093; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 363030; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 363750; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 364406; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 375365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 889892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1419440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1438584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1756799; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1782011; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1794058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1804763; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1818202; code bytes = 803024:T505,Found system information discovery API: "GetEnvironmentStringsW" in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin" Found system information discovery API: "GetSystemInfo" in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin" Found system information discovery API: "GetEnvironmentStrings (in long string)" in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin" Found system information discovery API: "syscall.GetEnvironmentStrings" in file "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin" Found system information discovery API: "GetSystemInfo" in "00000000-00007660.00000000.259890.00400000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00007660.00000000.259890.00400000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStrings (in long string)" in "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp" Found system information discovery API: "syscall.GetEnvironmentStrings" in "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp"25:T6ae,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found reference to API "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found reference to API "runtime.getLoadLibrary" (Indicator: "LoadLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007660.00000000.259890.00400000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007660.00000000.259890.00400000.00000004.mdmp") file/memory contains long string with (Indicator: "FreeLibrary"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp") file/memory contains long string with (Indicator: "LoadLibrary"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp") Found reference to API "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp") Found reference to API "runtime.getLoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp")26:T45d,Found string - ingSundaySyriacTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoYezidi[]bytechan<-efenceexec: hangupkilledlistenobjectpopcntrdtscprenameselectsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaPATHEXTRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboTagalogTibetanTirhutaTuesdayUNKNOWNWSARecvWSASend\\.\UNCtypes value=abortedallocmRallocmWconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= pacer: panic: runningsignal syscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeCyrillicDecemberDuployanEthiopicExtend; Source: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin")27:T598,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found reference to API "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found reference to API "runtime.getLoadLibrary" (Indicator: "LoadLibrary"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007660.00000000.259890.00400000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007660.00000000.259890.00400000.00000004.mdmp") file/memory contains long string with (Indicator: "LoadLibrary"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp") Found reference to API "runtime.getLoadLibraryEx" (Indicator: "LoadLibrary"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp") Found reference to API "runtime.getLoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp")28:T6e3,"status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWVirtualUnlockWriteConsoleWbad flushGen bad map statedalTLDpSugct?double unlockexchange fullexecRInternalfatal error: gethostbynamegetservbynamelevel 3 resetload64 failedmin too largenil stackbaseout of memoryprofMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGet" (Indicator: "CertCloseStore"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found api reference "s, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWVirtualUnlockWriteConsoleWbad flushGen bad map statedalTLDpSugct?double unlockexchange fullexecRInternalfatal error: gethostbynamegetservbynamelevel 3 resetload64 failedmin too largenil stackbaseout of memoryprofMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGet" (Indicator: "CertOpenStore"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found api reference "s, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWVirtualUnlockWriteConsoleWbad flushGen bad map statedalTLDpSugct?double unlockexchange fullexecRInternalfatal error: gethostbynamegetservbynamelevel 3 resetload64 failedmin too largenil stackbaseout of memoryprofMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGet" (Indicator: "CryptGenRandom"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found api reference "put/output errormultihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintruntime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr segmentation faultstopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDirectoryWGetTokenInformationHaiti Standard TimeIDS_Binary_OperatorIndia Standard TimeKhitan_Small_ScriptKorea Standard TimeLibya Standard TimeMultiByteToWideCharNepal Standard TimePattern_White_SpaceRussia Time Zone 10Russia Time Zone 11Samoa Standard TimeSetTokenInformationSudan Standard TimeSyri" (Indicator: "CryptReleaseContext"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pexec: canceling Cmdfile already closedfile already existsfile does not existillegal instructionm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectory" (Indicator: "CertOpenSystemStoreW"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pexec: canceling Cmdfile already closedfile already existsfile does not existillegal instructionm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectory" (Indicator: "CryptAcquireContextW"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found api reference "08:',address already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillcall not at safe pointcannot allocate memorycompileCallabck: type duplicated defer entryfreeIndex is not validgetenv before env initheadTailIndex overflowinteger divide by zerointerface conversion: kernel32.dll not foundminpc or maxpc invalidnetwork is unreachablenon-Go function at pc=oldoverflow is not nilprotocol not availableprotocol not supportedremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemsscanstack - bad statussend on closed channelspan has no free spacestack not a power of 2trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p state) must be a power of 223283064365386962890625Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVaria" (Indicator: "CertGetCertificateChain"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found api reference "08:',bytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left over markroot jobsmakechan: bad alignmentmissing type in runfinqnanotime returning zerono space left on deviceoperation not permittedoperation not supportedpanic during preemptoffprocresize: invalid argreflect.Value.Interfacereflect.Value.NumMethodreflect.methodValueCallruntime: internal errorruntime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding locksshrinkstack at bad timespan has no free stacksstack growth after forksyntax error in patternsystem huge page size (work.nwait > work.nproc116415321826934814453125582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard" (Indicator: "CertFreeCertificateChain"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found api reference "lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnableunexpected fault address unexpected key value type1455191522836685180664062572759576141834259033203125Bougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeGetFileInformationByHandleLine Islands Standard TimeNewfoundland Standard TimePostQueuedCompletionStatusSaint Pierre Standard TimeSetFileInformationByHandleSouth Africa Standard TimeW. Australia Standard TimeWest Pacific Standard Timecall from unknown functioncorrupted semaphore ticketentersyscall inconsistent forEachP: P did not run fnfreedefer with d.fn != nilinvalid argument to Int31ninvalid argument to Int63ninvalid request descriptorname not unique on networknegative idle mark workersno CSI structure availableno message of desired typenotewakeup - double wakeupout of memory (stackalloc)persistentalloc: size == 0required key not availableruntime: bad span s.state=" (Indicator: "CertFreeCertificateContext"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found api reference "runtime: pcHeader: magic= shrinking stack in libcallstartlockedm: locked to meunknown ABI parameter kinduse of invalid sweepLockerwakep: negative nmspinning not in stack roots range [363797880709171295166015625: unexpected return pc for CertEnumCertificatesInStoreEaster Island Standard TimeG waiting list is corruptedaddress not a stack addresschannel number out of rangecommunication error on sendcould not find QPC syscallsfailed to set sweep barriergcstopm: not waiting for gcgrowslice: len out of rangeinternal lockOSThread errorinvalid profile bucket typekey was rejected by servicemakechan: size out of rangemakeslice: cap out of rangemakeslice: len out of rangemspan.sweep: bad span statenot a XENIX named type fileprogToPointerMask: overflowrunlock of unlocked rwmutexruntime: asyncPreemptStack=runtime: checkdead: find g runtime: checkdead: nmidle=runtime: corrupted polldescruntime: netpollinit failedruntime: thread ID overflowruntime" (Indicator: "CertEnumCertificatesInStore"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin") Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "EvalSymlinks: too many linksFixedStack is not power-of-2GetFileInformationByHandleExPrepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedproto" (Indicator: "CertCreateCertificateContext"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin"), Found api reference "tack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125CertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before NextWSAGetOverlappedResult not found" not supported for cpu option "crypto/aes: input not full blockend outside usable address spaceinvalid limiter event type foundnumerical argument out of domainpanic while printing panic valuereflect.nameFrom: tag too long: removespecial on invalid pointerresource temporarily unavailableruntime.semasleep wait_abandonedruntime: failed to release pagesruntime: fixalloc size too largeruntime: mcall function returnedruntime: newstack called from g=runtime: root level max pages = runtime: setevent failed; errno=runtime: stack split at bad timeruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevscanstack: goroutine not stoppedscavenger state is already wiredslice bounds out of" (Indicator: "CertAddCertificateContextToStore"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin"), Found api reference "tack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125CertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before NextWSAGetOverlappedResult not found" not supported for cpu option "crypto/aes: input not full blockend outside usable address spaceinvalid limiter event type foundnumerical argument out of domainpanic while printing panic valuereflect.nameFrom: tag too long: removespecial on invalid pointerresource temporarily unavailableruntime.semasleep wait_abandonedruntime: failed to release pagesruntime: fixalloc size too largeruntime: mcall function returnedruntime: newstack called from g=runtime: root level max pages = runtime: setevent failed; errno=runtime: stack split at bad timeruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevscanstack: goroutine not stoppedscavenger state is already wiredslice bounds out of" (Indicator: "CertVerifyCertificateChainPolicy"; File: "f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin"), Found api reference "entersyscallexit status gcBitsArenasgcpacertraceharddecommithost is downillegal seekinvalid pathinvalid slotiphlpapi.dllkernel32.dlllfstack.pushmadvdontneedmheapSpecialmspanSpecialnetapi32.dllnot pollablerandautoseedreleasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringswirep: p->m=worker mode != sweepgen MB globals MB) workers= called from flushedWork idlethreads= is nil not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= gp->status= not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWVirtualUnlockWriteConsoleWbad flushGen bad map statedalTLDpSugct?double unlockexchange fullexecRInternalfatal error: gethostbynamegetservbynamelevel 3 resetload64 failedmin too largenil stackbaseout of memoryprofMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabvalue method xadd64 failedxchg64 failed}" (Indicator: "CertOpenStore"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp") Found api reference "1907348632812595367431640625CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltednil elem type!no module datano such deviceprotocol errorruntime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.PointeruserArenaStatewinapi error #work.full != 0 with GC prog" (Indicator: "CertCloseStore"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp") Found api reference "1907348632812595367431640625CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorylevel 2 haltedlevel 3 haltednil elem type!no module datano such deviceprotocol errorruntime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo many linkstoo many usersunexpected EOFunknown methodunreachable: unsafe.PointeruserArenaStatewinapi error #work.full != 0 with GC prog" (Indicator: "CryptGenRandom"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp") Found api reference "23283064365386962890625Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeSetEnvironmentVariableWSingapore Standard TimeSri Lanka Standard TimeTocantins Standard TimeVenezuela Standard TimeVolgograd Standard TimeW. Europe Standard TimeWest Asia Standard TimeWest Bank Standard Time" not found in registry", missing CPU support" (Indicator: "CertGetCertificateChain"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp") Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "EvalSymlinks: too many linksFixedStack is not power-of-2GetFileInformationByHandleExPrepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignal" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp")32:T7e3," nul & del \"C:\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\""" (Indicator: "ping 127"; Source: "00000000-00007660-00000C47-3848885292") Found string "cmd /c "ping 127.0.0.1 -n 2 > nul & del \"C:\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\""" (Indicator: "ping 127"; Source: "00000000-00007660.00000000.259890.00400000.00000004.mdmp") Found string "ping 127.0.0.1 -n 2 > nul & del "C:\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp"" (Indicator: "ping 127"; Source: "00000000-00007660.00000000.259890.00400000.00000004.mdmp") Found string "cmd /c "ping 127.0.0.1 -n 2 > nul & del \"C:\f22db650cc49c7a4e5bCommonProgramFiles(x86)=C:\Program Files (x86)\Common Files" (Indicator: "ping 127"; Source: "00000000-00007660.00000000.259890.00400000.00000004.mdmp") file/memory contains long string with (Indicator: "ping 127"; Source: "00000000-00007660.00000000.259890.00D5E000.00000002.mdmp")18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe","sha256":"a1cd7a2276b5a9bfbe34393a9565cad55d02da3934faa5b6a2c2607be7684831","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"verdict":"malicious"}],"files_deleted":[],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"path":"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["gdi32full.dll","ole32.dll","user32.dll","cryptbase.dll","VxSSL64.dll","gdi32.dll","KernelBase.dll","advapi32.dll","combase.dll","powrprof.dll","imm32.dll","winmm.dll","ucrtbase.dll","apphelp.dll","cryptsp.dll","IPHLPAPI.DLL","winnsi.dll","fltLib.dll","rpcrt4.dll","oleaut32.dll","winmmbase.dll","win32u.dll","bcryptprimitives.dll","mswsock.dll","ntdll.dll","shlwapi.dll","wship6.dll","msvcp_win.dll","kernel32.dll","sechost.dll","cfgmgr32.dll","WSHTCPIP.DLL","ws2_32.dll","wshqos.dll","msvcrt.dll","nsi.dll"],"processes":[{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAU0lEQVR4XmNgGA7ALLPlP7rYKBgFo2AUjAKagQ8fPvzHhdHV0gSgWzrqgCHlgGuT5QmqIQjQLSXFAVQB6JbS3QGjYBSMglEAAgeXmowWOqOAagAAhufB4piXdEYAAAAASUVORK5CYII=","name":"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe","normalized_path":"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe","pid":7660,"ppid":0,"sha256":"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29","uid":"00000000-00007660"},{"command_line":"cmd /c \"ping 127.0.0.1 -n 2 > nul & del \\\"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\\\"\"","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00007660","pid":1568,"ppid":7660,"sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","uid":"00000000-00001568"},{"command_line":"ping 127.0.0.1 -n 2","name":"PING.EXE","normalized_path":"%WINDIR%\\system32\\PING.EXE","parent_uid":"00000000-00001568","pid":6004,"ppid":1568,"sha256":"a97f91d6f165705edd286aeff25691806759bfdb051b20c4853965247dda36da","uid":"00000000-00006004"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},"registry_activity":{"keys_created":[],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2026-02-28T01:04:41+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"69a23f28c410b2731b007dbf","indicators_count":{"informative":136,"malicious":4,"suspicious":16},"is_in_unified_schema":true,"malware_family":"Trojan.Win64.GenPsw","state":"SUCCESS","submit_name":"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin","tags":["Multi-Process","Extracted Files"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":1,"files_deleted_count":0,"files_written_count":2,"http_requests_count":0,"imported_dlls_count":36,"injected_processes_count":0,"mutex_created_count":0,"process_count":3,"registry_keys_created_count":0,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"script_calls_count":0,"spawned_processes_count":3}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Trojan.Generic"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Win.Wacatac","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Win32.Agent","verdict":"malicious"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_-10","verdict":"malicious"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TR/W32.Dh.A","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.GenericKD.78296466","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win.Malware.Wingo-10059250-0","verdict":"malicious"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.GenericKD.78296466 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"a variant of WinGo/Agent.ATI trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win64.Agent.oa!s1","verdict":"malicious"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/W64.Agent.hk","verdict":"malicious"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan ( 006d8c5f1 )","verdict":"malicious"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W64/Trojan3.ASNK","verdict":"malicious"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win64.GenPsw.JFJ","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Agent.Win32.4419110","verdict":"malicious"}}},"incidents":[{"details":[{"detail":"Creates new processes"}],"details_count":1,"name":"Persistence","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"details":[{"detail":"Checks network status using ping"},{"detail":"Attempts to self-delete using a delete command"}],"details_count":2,"name":"Evasive","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Execution","technique":"Shared Modules"},{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"Account Discovery"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Encrypted/Encoded File"},{"attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Dynamic API Resolution"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Credential Access","technique":"OS Credential Dumping"},{"attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Checks network status using ping"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"Remote System Discovery"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"Local Account"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains a Wine emulator-related string"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"System Checks"},{"attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"},{"type":"informative","value":"Contains ability to check internet connectivity"},{"type":"informative","value":"Checks internet connectivity using tracert/ping"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"Internet Connection Discovery"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Masquerading"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"Domain Groups"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Persistence","technique":"Socket Filters"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Execution","technique":"Malicious File"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Application Layer Protocol"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"$22","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")","id":"string-148","level":"informative","mitre_attack_id":"T1622","name":"Contains ability to register a top-level exception handler (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$23","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"External Systems","description":"14/26 Antivirus vendors marked sample as malicious (53% detection rate)","id":"avtest-3","level":"malicious","name":"Sample was identified as malicious by a large number of Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$24","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c \"ping 127.0.0.1 -n 2 > nul & del \\\\\"C:\\\\f22db650cc49c7a4e ...\" (UID: 00000000-00001568)\n Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 2\" (UID: 00000000-00006004)","id":"target-25","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\" was detected as \"tElock v1.0 (private) -> tE!\"\n \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe\" was detected as \"tElock v1.0 (private) -> tE!\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$25","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Found reference to \"crypto/aes.gcmAesFinish\" (Indicator: \"Aes\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n Found reference to \"crypto/aes.gcmAesInit\" (Indicator: \"Aes\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n Found reference to \"crypto/aes.gcmAesData\" (Indicator: \"Aes\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n Found reference to \"crypto/aes.gcmAesDec\" (Indicator: \"Aes\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"\"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\" was detected as \"Go\" and name: \"Compiler\"\n \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe\" was detected as \"Go\" and name: \"Compiler\"","id":"static-157","level":"informative","mitre_attack_id":"T1027","name":"Matched Compiler/Packer signature (DIE)","origin":"Static Parser","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","id":"registry-25","level":"informative","mitre_attack_id":"T1082","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"System Security","description":"file/memory contains long string with (Indicator: \"OpenProcess\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"OpenProcess\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-729","level":"informative","mitre_attack_id":"T1489","name":"Able to retrieve/open a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"System Security","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-402","level":"informative","mitre_attack_id":"T1562.001","name":"Contains ability to modify process attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$26","id":"string-145","level":"informative","mitre_attack_id":"T1564","name":"Found virtual disk drive like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"\" nul & del \\\"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\\\"\"\" - (UID: 00000000-00007660)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"ping 127.0.0.1 -n 2\" - (UID: 00000000-00001568)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$29","id":"registry-172","level":"informative","mitre_attack_id":"T1012","name":"Queries registry keys","origin":"Registry Access","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"14/26 Antivirus vendors marked dropped file \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe\" as malicious (classified as \"Trojan.Win64.GenPsw\" with 53% detection rate)","id":"binary-11","level":"malicious","mitre_attack_id":"T1204.002","name":"The analysis extracted a file that was identified as malicious","origin":"Binary File","relevance":10,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"$2a","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-981","level":"informative","mitre_attack_id":"T1069.002","name":"Able to enumerate permission groups in the domain","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2b","id":"string-57","level":"informative","mitre_attack_id":"T1027","name":"Contains CRYPTO related strings","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2c","id":"string-85","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to enumerate process and/or its information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found reference to API \"runtime.getGetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n Found reference to API \"runtime.getGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-317","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve address of exported function from a DLL (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2d","id":"string-207","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to retrieve file and directory information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"CreateFile\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found reference to API \"syscall.CreateFile\" (Indicator: \"CreateFile\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"CreateFile\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n Found reference to API \"syscall.CreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"GetLastError\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\" nul & del \\\"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\\\"\"\" (Indicator: \"ping 127.0.0.1\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")\n Found string \"ping 127.0.0.1 -n 2 > nul & del \"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\"\" (Indicator: \"ping 127.0.0.1\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")\n Found string \"cmd /c \"ping 127.0.0.1 -n 2 > nul & del \\\"C:\\f22db650cc49c7a4e5bCommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files\" (Indicator: \"ping 127.0.0.1\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")","id":"string-573","level":"informative","mitre_attack_id":"T1016.001","name":"Contains ability to check internet connectivity","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Able to discover operating system information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"getsockname\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-224","level":"informative","mitre_attack_id":"T1016","name":"Contains ability to retrieve the local name for a socket (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$30","id":"string-121","level":"informative","mitre_attack_id":"T1033","name":"Contains ability to retrieve usernames and/or user information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"System Security","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"DeleteFile\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-308","level":"informative","mitre_attack_id":"T1070.004","name":"Contains ability to delete files/directories (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"System Security","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")","id":"string-77","level":"informative","mitre_attack_id":"T1134","name":"Contains ability to modify access token privileges (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"getaddrinfo\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-739","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve geographical location information","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe\" has type \"PE32+ executable for MS Windows 6.01 (GUI) x86-64 (stripped to external PDB) 7 sections\"- Location: [C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe]- [targetUID: 00000000-00007660]","id":"binary-0","level":"informative","mitre_attack_id":"T1105","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")","id":"string-535","level":"informative","mitre_attack_id":"T1105","name":"Contains ability to write files (API string)","origin":"File/Memory","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$31","id":"string-602","level":"informative","mitre_attack_id":"T1573","name":"Able to use Microsoft's Enhanced Cryptographic Provider","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"$32","id":"api-7","level":"informative","mitre_attack_id":"T1129","name":"Loads modules at runtime","origin":"API Call","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"$33","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"status is not in scan stategentraceback callback cannot be used with non-zero skipmheap.freeSpanLocked - invalid free of user arena chunkos: invalid use of WriteAt on file opened with O_APPENDreflect: internal error: invalid use of makeMethodValuefailed to allocate aligned heap memory; too many retriesin gcMark expecting to see gcphase as _GCmarkterminationnon-empty pointer map passed for non-pointer-size valuesprofilealloc called without a P or outside bootstrappingstrings: illegal use of non-zero Builder copied by value (set GODEBUG=execwait=2 to capture stacks for debugging)cannot run executable found relative to current directorygentraceback cannot trace user goroutine on its own stackruntime: checkmarks found unexpected unmarked object obj=GODEBUG=execwait=2 detected a leaked exec.Cmd created by:\" in Source: 00000000-00007660.00000000.259890.00D5E000.00000002.mdmp","id":"memorydump-10","level":"informative","mitre_attack_id":"T1012","name":"Found registry location strings in memory","origin":"Memory Dumps","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Network Related","description":"Heuristic match: \"*runtime.name\"\n Heuristic match: \"runtime.(*functype).in\"\n Heuristic match: \"runtime.(*bucket).mp\"\n Heuristic match: \"runtime.(*polldesc).info\"\n Heuristic match: \"runtime.name.name\"\n Pattern match: \"eq.sync/atomic.bool\"\n Pattern match: \"eq.sync/atomic.int32\"\n Heuristic match: \"internal/reflectlite.name.name\"\n Heuristic match: \"errors.is\"\n Pattern match: \"eq.sync/atomic.pointer\"\n Heuristic match: \"unicode.to\"\n Heuristic match: \"reflect.(*functype).in\"\n Heuristic match: \"reflect.name.name\"\n Heuristic match: \"reflect.flag.ro\"\n Heuristic match: \"reflect.value.int\"\n Heuristic match: \"syscall.errno.is\"\n Heuristic match: \"syscall.(*errno).is\"\n Heuristic match: \"sync.(*once).do\"\n Pattern match: \"eq.io/fs.patherror\"\n Heuristic match: \"c:\\programdata\\oracle\\java\\javapath\\cmd.com\"\n Pattern match: \"eq.math/rand.rand\"\n Pattern match: \"eq.os/exec.error\"\n Pattern match: \"eq.os/exec.wrappederror\"\n Pattern match: \"eq.os/exec.ctxresult\"\n Pattern match: \"eq.os/exec.goroutinestatus\"","id":"string-3","level":"informative","mitre_attack_id":"T1071","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\" nul & del \\\"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\\\"\"\" (Indicator: \"\"ping\"; Source: \"00000000-00007660-00000C47-3848885292\")\n Found string \"ping 127.0.0.1 -n 2\" (Indicator: \"ping \"; Source: \"00000000-00001568-00000C47-1666447390\")\n Found string \"cmd /c \"ping 127.0.0.1 -n 2 > nul & del \\\"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\\\"\"\" (Indicator: \"\"ping\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")\n Found string \"ping 127.0.0.1 -n 2 > nul & del \"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\"\" (Indicator: \"ping \"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")\n Found string \"cmd /c \"ping 127.0.0.1 -n 2 > nul & del \\\"C:\\f22db650cc49c7a4e5bCommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files\" (Indicator: \"\"ping\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")","id":"string-417","level":"informative","mitre_attack_id":"T1018","name":"Able to identify remote systems","origin":"File/Memory","relevance":7,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")","id":"string-452","level":"informative","mitre_attack_id":"T1087","name":"Contains ability to retrieve SID for the specified name (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\" nul & del \\\"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\\\"\"\"\n Potential IP \"127.0.0.1\" found in string \"ping 127.0.0.1 -n 2\"\n Potential IP \"127.0.0.1\" found in string \"ping 127.0.0.1 -n 2 > nul & del \"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\"\"\n Potential IP \"127.0.0.1\" found in string \"cmd /c \"ping 127.0.0.1 -n 2 > nul & del \\\"C:\\f22db650cc49c7a4e5bCommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files\"","id":"string-14","level":"informative","mitre_attack_id":"T1071","name":"Found potential IP address in binary/memory","origin":"File/Memory","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"System Security","description":"$3a","id":"string-114","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"$3b","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$3c","id":"string-309","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify thread functionality – possible hijack (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - AES encryption","id":"summary-32","level":"informative","mitre_attack_id":"T1140","name":"Shows ability to deobfuscate/decode files or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","id":"string-62","level":"informative","mitre_attack_id":"T1497.001","name":"Contains a Wine emulator-related string","origin":"File/Memory","relevance":5,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"GetSystemTime\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found reference to API \"syscall.FindFirstFile\" (Indicator: \"FindFirstFile\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"FindFirstFile\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"FindNextFile\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n Found reference to API \"syscall.FindFirstFile\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"informative","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":2,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"RegCloseKey\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$3d","id":"string-234","level":"informative","mitre_attack_id":"T1486","name":"Contains possible references to Golang crypto modules","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c \"ping 127.0.0.1 -n 2 > nul & del \\\\\"C:\\\\f22db650cc49c7a4e ...\" (UID: 00000000-00001568)\n Spawned process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 2\" (UID: 00000000-00006004)","id":"target-103","level":"informative","mitre_attack_id":"T1057","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Network Related","description":"Process \"PING.EXE\" with commandline \"ping 127.0.0.1 -n 2\" (UID: 00000000-00006004)","id":"target-348","level":"informative","mitre_attack_id":"T1016.001","name":"Checks internet connectivity using tracert/ping","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"route\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found string \"cmd /c \"ping 127.0.0.1 -n 2 > nul & del \\\"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\\\"\"\" (Indicator: \"ping\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")\n Found string \"ping 127.0.0.1 -n 2 > nul & del \"C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe.tmp\"\" (Indicator: \"ping\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")\n Found string \"cmd /c \"ping 127.0.0.1 -n 2 > nul & del \\\"C:\\f22db650cc49c7a4e5bCommonProgramFiles(x86)=C:\\Program Files (x86)\\Common Files\" (Indicator: \"ping\"; Source: \"00000000-00007660.00000000.259890.00400000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"route\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-126","level":"informative","mitre_attack_id":"T1082","name":"Found system command-related strings","origin":"File/Memory","relevance":7,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"System Security","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")","id":"string-426","level":"informative","mitre_attack_id":"T1222","name":"Contains ability to modify file attributes (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe\" has type \"PE32+ executable for MS Windows 6.01 (GUI) x86-64 (stripped to external PDB) 7 sections\"- Location: [C:\\f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin.exe]- [targetUID: 00000000-00007660]","id":"binary-1","level":"suspicious","mitre_attack_id":"T1105","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"$3e","id":"api-176","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to retrieve function addresses","origin":"API Call","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"General","description":"$3f","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$40","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$41","id":"api-161","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files (non-executable)","origin":"API Call","relevance":3,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"Network Related","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n Found reference to API \"syscall.CreatePipe\" (Indicator: \"CreatePipe\"; File: \"f22db650cc49c7a4e5bccd15eb7cc55d232f0367ab984a1987a702dd82edca29.bin\")\n file/memory contains long string with (Indicator: \"CreatePipe\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")\n Found reference to API \"syscall.CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00007660.00000000.259890.00D5E000.00000002.mdmp\")","id":"string-210","level":"informative","mitre_attack_id":"T1559","name":"Contains ability to create/connect to a named pipe (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"External Systems","description":"14/26 Antivirus vendors marked sample as malicious (53% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"69a23f28c410b2731b007dbf","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"