26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Variadic.A.410.Generic Sample f530c59ffce9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f530c59ffce9…. Malware family: Variadic.A.410.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 12 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8","keywords":["Malicious","Variadic.A.410.Generic","malware analysis","sandbox report","threat intelligence","f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8"],"about":{"@type":"SoftwareApplication","name":"arinzezx.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Variadic.A.410.Generic","antivirusDetections":{"malicious":8,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T43a,"arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "arinzezx.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG")28:T7a1,"arinzezx.exe" called "FindFirstFileW" with parameter C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindFirstFileW" with parameter C:\Windows\Microsoft.NET\Framework\\* (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003116) "arinzezx.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003116)29:T5a3,"arinzezx.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\arinzezx_RASAPI32" (Filter: 14; Subtree: 1113344) "arinzezx.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\arinzezx_RASAPI32" (Filter: 14; Subtree: 9867008) "arinzezx.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 9722112) "arinzezx.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 9722112) "arinzezx.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\arinzezx_RASMANCS" (Filter: 14; Subtree: 1113344) "arinzezx.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\arinzezx_RASAPI32" (Filter: 14; Subtree: 9868288) "arinzezx.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\arinzezx_RASMANCS" (Filter: 14; Subtree: 9868288) "arinzezx.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" (Filter: 4; Subtree: 1113345) "arinzezx.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" (Filter: 4; Subtree: 1113345) "arinzezx.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 4; Subtree: 1113345)2a:T493,"arinzezx.exe" opened file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\YA LOGIN DATA" "arinzezx.exe" opened file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" opened file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOGIN DATA" "arinzezx.exe" opened file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" opened file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\FILEZILLA\RECENTSERVERS.XML" "arinzezx.exe" opened file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" opened file "C:\Users\%OSUSER%\AppData\Roaming\COMODO\ICEDRAGON\PROFILES" "arinzezx.exe" opened file "%LOCALAPPDATA%\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\YA LOGIN DATA" "arinzezx.exe" opened file "%LOCALAPPDATA%\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" opened file "%LOCALAPPDATA%\Google\Chrome\User Data\DEFAULT\LOGIN DATA" "arinzezx.exe" opened file "%LOCALAPPDATA%\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA"2b:Tea8,"arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "SMTP PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "HTTP PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "POP3 PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "IMAP PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "SMTP PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "HTTP PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "POP3 PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "IMAP PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "HTTP PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "IMAP PASSWORD") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "arinzezx.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001")2c:Ta9a,"arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\YA LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XPOM\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GHOSTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XVAST\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA" "arinzezx.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA_I18N\DEFAULT\UC LOGIN DATA.18"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790381625224,"unified_at":"2026-09-26T00:13:45.224Z","metadata":{"hashes":{"sha256":"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8","sha1":"69a0542ef518fde2a20521b23f95e183a0b5a3a4","md5":"ee0c5f050f0bc0b1ad6065c583ba5ea2","sha512":"855969a9bd8e0d59a14fbd8441e079d23a481577419ecd353de850cd428a2c741acdb3ff77b9e0946d8aeaf42117d00a467e78e7daf42687b63cf0ae32084eee","ssdeep":"12288:KYGE7JFGAKI9ATUYBypzje7UdTdsMKMcS9D1Qyz6Ps4qcbIZ8hzBwidJCuMqz1KS:YWS0AGdjYmTdFNPQs4qkIZozBwidsAB","ssdeep_chunks":["12288:KYGE7JF","12288:YGE7JFG","12288:GE7JFGA","12288:E7JFGAK","12288:7JFGAKI","12288:JFGAKI9","12288:FGAKI9A","12288:GAKI9AT","12288:AKI9ATU","12288:KI9ATUY","12288:I9ATUYB","12288:9ATUYBy","12288:ATUYByp","12288:TUYBypz","12288:UYBypzj","12288:YBypzje","12288:Bypzje7","12288:ypzje7U","12288:pzje7Ud","12288:zje7UdT","12288:je7UdTd","12288:e7UdTds","12288:7UdTdsM","12288:UdTdsMK","12288:dTdsMKM","12288:TdsMKMc","12288:dsMKMcS","12288:sMKMcS9","12288:MKMcS9D","12288:KMcS9D1","12288:McS9D1Q","12288:cS9D1Qy","12288:S9D1Qyz","12288:9D1Qyz6","12288:D1Qyz6P","12288:1Qyz6Ps","12288:Qyz6Ps4","12288:yz6Ps4q","12288:z6Ps4qc","12288:6Ps4qcb","12288:Ps4qcbI","12288:s4qcbIZ","12288:4qcbIZ8","12288:qcbIZ8h","12288:cbIZ8hz","12288:bIZ8hzB","12288:IZ8hzBw","12288:Z8hzBwi","12288:8hzBwid","12288:hzBwidJ","12288:zBwidJC","12288:BwidJCu","12288:widJCuM","12288:idJCuMq","12288:dJCuMqz","12288:JCuMqz1","12288:CuMqz1K","12288:uMqz1KS","24576:KYGE7JF","24576:YGE7JFG","24576:GE7JFGA","24576:E7JFGAK","24576:7JFGAKI","24576:JFGAKI9","24576:FGAKI9A","24576:GAKI9AT","24576:AKI9ATU","24576:KI9ATUY","24576:I9ATUYB","24576:9ATUYBy","24576:ATUYByp","24576:TUYBypz","24576:UYBypzj","24576:YBypzje","24576:Bypzje7","24576:ypzje7U","24576:pzje7Ud","24576:zje7UdT","24576:je7UdTd","24576:e7UdTds","24576:7UdTdsM","24576:UdTdsMK","24576:dTdsMKM","24576:TdsMKMc","24576:dsMKMcS","24576:sMKMcS9","24576:MKMcS9D","24576:KMcS9D1","24576:McS9D1Q","24576:cS9D1Qy","24576:S9D1Qyz","24576:9D1Qyz6","24576:D1Qyz6P","24576:1Qyz6Ps","24576:Qyz6Ps4","24576:yz6Ps4q","24576:z6Ps4qc","24576:6Ps4qcb","24576:Ps4qcbI","24576:s4qcbIZ","24576:4qcbIZ8","24576:qcbIZ8h","24576:cbIZ8hz","24576:bIZ8hzB","24576:IZ8hzBw","24576:Z8hzBwi","24576:8hzBwid","24576:hzBwidJ","24576:zBwidJC","24576:BwidJCu","24576:widJCuM","24576:idJCuMq","24576:dJCuMqz","24576:JCuMqz1","24576:CuMqz1K","24576:uMqz1KS","12288:YWS0AGd","12288:WS0AGdj","12288:S0AGdjY","12288:0AGdjYm","12288:AGdjYmT","12288:GdjYmTd","12288:djYmTdF","12288:jYmTdFN","12288:YmTdFNP","12288:mTdFNPQ","12288:TdFNPQs","12288:dFNPQs4","12288:FNPQs4q","12288:NPQs4qk","12288:PQs4qkI","12288:Qs4qkIZ","12288:s4qkIZo","12288:4qkIZoz","12288:qkIZozB","12288:kIZozBw","12288:IZozBwi","12288:ZozBwid","12288:ozBwids","12288:zBwidsA","12288:BwidsAB"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"arinzezx.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":956928,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1677689868000,"last_seen":1677690010000,"last_multi_scan":1677690010000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":28},"sandbox_signatures":{"informative_count":39,"suspicious_count":24,"malicious_count":12,"total":75},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.SnakeStealer.gwore","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Variadic.A.410.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.IYR.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Variadic.A.410.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/GenKryptik.GGTW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.AgentTesla.jd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Variadic.A.410.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to start a process"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode string content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Privilege Escalation","technique":"Portable Executable Injection","attack_id":"T1055.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/002","identifiers":[{"type":"malicious","value":"Writes PE header to memory"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal desktop applications information (file access)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"suspicious","value":"Tries to steal Pidgin account information (file access)"},{"type":"suspicious","value":"Tries to access browsers sensitive information (file access)"},{"type":"suspicious","value":"Checks on FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function \"Concat\" in \"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin\"\n Observed function \"ToString\" in \"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin\"\n Observed function \"Split\" in \"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin\"\n Observed function \"Join\" in \"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin\"\n Observed function \"Replace\" in \"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"wCyXw.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Contains ability to start a process","description":"Observed function \"Process.Start\" in \"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 72480000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \".exe\" loaded module \"KERNEL32\" at base 776d0000\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \".exe\" loaded module \"ADVAPI32.DLL\" at base 76160000\n \".exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSCOREEI.DLL\" at base 6d7b0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"100011000e033472@ADVAPI32.dll\"\n \"0d000e0022033472@ADVAPI32.dll\"\n \"0d000e00fe023472@ADVAPI32.dll\"\n \"0b000c00cc023472@ADVAPI32.dll\"\n \"10001100da023472@ADVAPI32.dll\"\n \"150016002c7a876d@ADVAPI32.dll\"\n \"0e000f00a47a876d@ADVAPI32.dll\"\n \"0e000f00d87a876d@ADVAPI32.dll\"\n \"11001200387f876d@ADVAPI32.dll\"\n \"11001200a47f876d@ADVAPI32.dll\"\n \"12001300b87f876d@ADVAPI32.dll\"\n \"12001300e07f876d@ADVAPI32.dll\"\n \"14001500bc93876d@ADVAPI32.dll\"\n \"1b001c00381f7b6d@api-ms-win-core-synch-l1-2-0.DLL\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin\" file has an entrypoint instructions - \"jmp\tdword ptr [0x402000],add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,in\tal, dx,cmp\tedx, edi,inc\tbyte ptr [edx + 0x2e],out\t0x3f, al,add\tah, byte ptr [eax],sub\tbh, dl,or\tebp, dword ptr [ebx + 0x2cfa3ffc],xchg\teax, edx,jl\t0x4e83b0,insb\tbyte ptr es:[edi], dx,or\tdword ptr [eax - 0x37], eax,jns\t0x4e8453,cmp\tal, 0x64,adc\teax, dword ptr es:[eax - 0x36],add\tedi, ecx,cmp\tah, byte ptr [edi],push\tecx,sbb\tal, byte ptr [eax + 0x30],int3\t,sub\teax, 0x210ce1f3,inc\teax,or\teax, 0x8e82fcb7,xor\teax, 0xf7cf4025,cmpsd\tdword ptr [esi], dword ptr es:[edi],and\tdword ptr [ecx + 0x1540299a], ecx,dec\tebp,xchg\teax, ebp,nop\t,jne\t0x4e846f,inc\teax,je\t0x4e83cb,cmp\tbh, byte ptr [edi],xchg\teax, edi,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\".exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\MSCORWKS.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\CLR.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\MSCORWKS.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CLR.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"YT.GP\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Dotnet file resource with suspicious entropy","description":"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin has big resource with name: \"L2\" size: \"7293956\" and abnormal entropy:\"7.99631783183\"\n f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin has big resource with name: \"L1\" size: \"7951130\" and abnormal entropy:\"7.99631798896\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc\n .reloc with unusual entropies 7.58856944258\n 7.81090481752\n 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found - (Indicator: \"des\") in Source: f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"46/69 Antivirus vendors marked sample as malicious (66% detection rate)\n 2/21 Antivirus vendors marked sample as malicious (9% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"yq@s.g\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin\" has resource with unusual entropy \"RT_ICON:7.95793901743\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) at ee0c5f050f0bc0b1ad6065c583ba5ea2-600003b-Form1~InitializeComponent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"16.0.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"QueueUserWorkItem\" (Source: f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin, API is part of module: KERNEL32.DLL)\n Found string \"Rectangle\" (Source: f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8.bin, API is part of module: GDI32.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"db4d307200000000\" to virtual address \"0x01382000\" (part of module \"F530C59FFCE92C129896BBE4C2DF821AC097D696E2A3F3F99E3BD4AAA5C6ACE8.EXE\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/69 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\"arinzezx.exe\" called \"IsWow64Process\" with parameter \"3116\" - (UID: 00000000-00003116)\n \"arinzezx.exe\" called \"IsWow64Process\" with parameter \"2704\" - (UID: 00000000-00002704)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"arinzezx.exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003116)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"arinzezx.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003116)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\"arinzezx.exe\" called \"LookupAccountSidW\" (UID: 00000000-00002704)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"arinzezx.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003116)\n \"arinzezx.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003116)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"arinzezx.exe\" queries volume information of \"C:\\arinzezx.exe\" at 00000000-00003116-00000046-10638260700305279\n \"arinzezx.exe\" queries volume information of \"C:\\arinzezx.exe\" at 00000000-00002704-00000046-2653585\n \"arinzezx.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Web.Extensions\\v4.0_4.0.0.0__31bf3856ad364e35\\System.Web.Extensions.dll\" at 00000000-00002704-00000046-14222791\n \"arinzezx.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Web.Extensions\\v4.0_4.0.0.0__31bf3856ad364e35\\System.Web.Extensions.dll\" at 00000000-00002704-00000046-14237900","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"arinzezx.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"arinzezx.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"arinzezx.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\(UID: 00000000-00003116)\n \"arinzezx.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\(UID: 00000000-00002704)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"arinzezx.exe\" called \"CreateProcessA\" with parameter \"C:\\arinzezx.exe\" - (UID: 00000000-00003116)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"193.122.130.0:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"arinzezx.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70430000\n \"arinzezx.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6E8F0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"arinzezx.exe\" (UID: 00000000-00000660) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"arinzezx.exe\" (UID: 00000000-00000660) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"arinzezx.exe\" (UID: 00000000-00000660)\n Spawned process \"arinzezx.exe\" (UID: 00000000-00002704)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"arinzezx.exe\" (UID: 00000000-00000660)\n Spawned process \"arinzezx.exe\" (UID: 00000000-00002704)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"arinzezx.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"arinzezx.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003116)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"arinzezx.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003116)\n \"arinzezx.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002704)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$28","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"arinzezx.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"arinzezx.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"arinzezx.exe\" at 00000000-00003116-00000033-10638260702772093\n \"arinzezx.exe\" at 00000000-00002704-00000033-6522496","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"arinzezx.exe\" queried SystemProcessInformation at 00000000-00003116-00000033-3481896\n \"arinzezx.exe\" queried SystemProcessInformation at 00000000-00003116-00000033-3482601\n \"arinzezx.exe\" queried SystemProcessInformation at 00000000-00002704-00000033-3843609\n \"arinzezx.exe\" queried SystemProcessInformation at 00000000-00002704-00000033-12320886","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"arinzezx.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to steal Pidgin account information (file access)","description":"\"arinzezx.exe\" trying to open a file \"%APPDATA%\\.PURPLE\\ACCOUNTS.XML\"\n \"arinzezx.exe\" trying to open a file \"%APPDATA%\\.PURPLE\\ACCOUNTS.XML\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-116","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"arinzezx.exe\" allocated at least 32768 KB of consecutive memory with 106 calls","origin":"API Call","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Detects sample launching another instance of itself","description":"C:\\arinzezx.exe","origin":"API Call","relevance":8,"id":"api-8704","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$29","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 193.122.130.0 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"arinzezx.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003116)\n \"arinzezx.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002704)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"$2a","origin":"API Call","mitre_attack_id":"T1005","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access browsers sensitive information (file access)","description":"\"arinzezx.exe\" trying to open a file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"arinzezx.exe\" trying to open a file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-132","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access mail clients information (file access)","description":"\"arinzezx.exe\" trying to open a file \"%APPDATA%\\THUNDERBIRD\\PROFILES\"\n \"arinzezx.exe\" trying to open a file \"%APPDATA%\\POSTBOXAPP\\PROFILES\"\n \"arinzezx.exe\" trying to open a file \"%APPDATA%\\THUNDERBIRD\\PROFILES\"\n \"arinzezx.exe\" trying to open a file \"%APPDATA%\\POSTBOXAPP\\PROFILES\"","origin":"API Call","mitre_attack_id":"T1114","relevance":5,"id":"api-131","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"arinzezx.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"arinzezx.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"arinzezx.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"arinzezx.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"arinzezx.exe\" called \"CreateProcessA\" with parameter \"C:\\arinzezx.exe\" - (UID: 00000000-00003116)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Writes PE header to memory","description":"\"arinzezx.exe wrote PE header bytes (\"MZ\") to a remote process \"C:\\arinzezx.exe\"\n which might be an injection preparation attempt ...","origin":"API Call","mitre_attack_id":"T1055.002","relevance":7,"id":"api-83","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"22/70 Antivirus vendors marked spawned process \"arinzezx.exe\" (PID: 660) as malicious (classified as \"Gen:Heur.Variadic.A.410\" with 31% detection rate)\n 22/70 Antivirus vendors marked spawned process \"arinzezx.exe\" (PID: 2704) as malicious (classified as \"Gen:Heur.Variadic.A.410\" with 31% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"arinzezx.exe\" allocated memory in \"C:\\arinzezx.exe\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"arinzezx.exe\" wrote 32 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 760)\n \"arinzezx.exe\" wrote 52 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 760)\n \"arinzezx.exe\" wrote 4 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 760)\n \"arinzezx.exe\" wrote 8 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 760)\n \"arinzezx.exe\" wrote 32 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 780)\n \"arinzezx.exe\" wrote 52 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 780)\n \"arinzezx.exe\" wrote 4 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 780)\n \"arinzezx.exe\" wrote 8 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 780)\n \"arinzezx.exe\" wrote 512 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 780)\n \"arinzezx.exe\" wrote 125440 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 780)\n \"arinzezx.exe\" wrote 4608 bytes to a remote process \"C:\\arinzezx.exe\" (Handle: 780)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$2c","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\"arinzezx.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \"arinzezx.exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"},{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Tries to steal desktop applications information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Tries to identify its external IP address"},{"detail":"Reads the windows installation language"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":87,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"640f319ce7c0d89ab90cd6ad","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Variadic.A.410","submit_name":"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8","analysis_start_time":"2023-03-13T14:22:21+00:00","indicators_count":{"informative":13,"suspicious":9,"malicious":3},"is_in_unified_schema":true},{"id":"63ff83ea128d2bc26207091e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Variadic.A.410","contacted_countries":["USA"],"submit_name":"arinzezx.exe","analysis_start_time":"2023-03-01T16:57:16+00:00","indicators_count":{"informative":39,"suspicious":28,"malicious":13},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.122.130.0","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]}],"dns_resolutions":[{"domain":"checkip.dyndns.org","address":"193.122.130.0","ttl":317,"country":"United States","registrar_name":"Tucows Inc.","registrar_organization":"Dynamic Network Services, Inc.","registrar_name_servers":"NS2.DYNDNS.ORG","registrar_creation_date":"1998-11-22T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]}],"http_requests":[{"host":"checkip.dyndns.org","host_ip":"193.122.130.0:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}],"processes":[{"pid":3116,"ppid":0,"name":"arinzezx.exe","command_line":"","sha256":"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8","normalized_path":"C:\\arinzezx.exe","uid":"00000000-00003116","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAA0UlEQVR42mNgGAWjYBSMgqEOzMwt/g+Ixc9evv3Pxsb2/97Dp/9BbLpbDsPIfLpbju4AmjsC3XJcjjA2Mf1PMwfgcgi6+ONnr/7TxPeEQmLFqrX/qR4lMMOOHDuF1wHIFlLsCGIMppkjSLEcl3h+QRH5OYRYSwjJRUXHkldOoFuw98BhrBawsrIRlSYodgA2g3X19P4TmyZo4gBSLaeqA3r7J/43MjImyfJLV2/+p0qxSw6+fO3mwFTZJIHz80r/0xOPbAdY6Sj+H9BoGG1JIwMARQJJXGktpsIAAAAASUVORK5CYII="},{"pid":660,"ppid":3116,"name":"arinzezx.exe","command_line":"","sha256":"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8","normalized_path":"C:\\arinzezx.exe","parent_uid":"00000000-00003116","uid":"00000000-00000660"},{"pid":2704,"ppid":3116,"name":"arinzezx.exe","command_line":"","sha256":"f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8","normalized_path":"C:\\arinzezx.exe","parent_uid":"00000000-00003116","uid":"00000000-00002704"}],"all_imported_dlls":["nsi.dll","ole32.dll","KernelBase.dll","sechost.dll","gdi32.dll","lpk.dll","oleaut32.dll","fltLib.dll","imm32.dll","msctf.dll","mscoree.dll","mscoreei.dll","kernel32.dll","ws2_32.dll","ntdll.dll","user32.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","advapi32.dll","msvcrt.dll","rpcrt4.dll","urlmon.dll","api-ms-win-downlevel-version-l1-1-0.dll","clr.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","IPHLPAPI.DLL","userenv.dll","vcruntime140_clr0400.dll","rasapi32.dll","ucrtbase_clr0400.dll","System.Drawing.ni.dll","System.Xml.ni.dll","RpcRtRemote.dll","dnsapi.dll","rasadhlp.dll","profapi.dll","rsaenh.dll","mscorrc.dll","winhttp.dll","FWPUCLNT.DLL","Microsoft.VisualBasic.ni.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","normaliz.dll","shell32.dll","tzres.dll","wow64win.dll","comctl32.dll","mswsock.dll","wship6.dll","webio.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wow64cpu.dll","uxtheme.dll","System.Configuration.ni.dll","bcrypt.dll","cryptsp.dll","dhcpcsvc6.dll","wow64.dll","clrjit.dll","cfgmgr32.dll","iertutil.dll","System.Windows.Forms.dll","nlssorting.dll","dhcpcsvc.dll","WindowsCodecs.dll","version.dll","GdiPlus.dll","sspicli.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Windows.Forms.ni.dll","System.Core.ni.dll","credssp.dll","winnsi.dll","psapi.dll","shlwapi.dll","System.ni.dll","wininet.dll","cryptbase.dll","mscorlib.ni.dll","WSHTCPIP.DLL","apphelp.dll","rasman.dll","rtutils.dll","System.Web.Extensions.dll","api-ms-win-downlevel-user32-l1-1-0.dll","secur32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"640f319ce7c0d89ab90cd6ad"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"63ff83ea128d2bc26207091e"}]}]}},"report_ids":{"sandbox_job_ids":["63ff83ea128d2bc26207091e","640f319ce7c0d89ab90cd6ad"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Variadic.A.410.Generic Sample f530c59ffce9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f530c59ffce9…. Malware family: Variadic.A.410.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 12 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8"}],["$","meta","4",{"property":"og:title","content":"Malicious Variadic.A.410.Generic Sample f530c59ffce9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f530c59ffce9…. Malware family: Variadic.A.410.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 12 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f530c59ffce92c129896bbe4c2df821ac097d696e2a3f3f99e3bd4aaa5c6ace8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Variadic.A.410.Generic Sample f530c59ffce9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f530c59ffce9…. Malware family: Variadic.A.410.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 12 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]