24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T506,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample feea6bd8a190… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample feea6bd8a190…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 19/27 AV engines flagged this file. 7 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0"],"about":{"@type":"SoftwareApplication","name":"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta16,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Dispose" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteTo" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Capacity" in "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin"26:Te1f,Found reference to "PbeSha1_RC2_40" (Indicator: "RC2"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "RC2_CBC_40" (Indicator: "RC2"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "SRTP_NULL_HMAC_SHA1_80" (Indicator: "HMAC"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_80" (Indicator: "HMAC"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "HMAC_SHA1" (Indicator: "HMAC"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "EncryptionECDsaWithSha1" (Indicator: "ECDsa"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "TRAILER_SHA512" (Indicator: "SHA512"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "ecka_eg_X963kdf_SHA512" (Indicator: "SHA512"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "sphincs256_with_SHA512" (Indicator: "SHA512"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "xmss_with_SHA512" (Indicator: "SHA512"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "xmss_mt_with_SHA512" (Indicator: "SHA512"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "ecdsa_plain_SHA512" (Indicator: "SHA512"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "EncryptionECDsaWithSha512" (Indicator: "ECDsa"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "SRTP_NULL_HMAC_SHA1_32" (Indicator: "HMAC"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "SRTP_AES128_CM_HMAC_SHA1_32" (Indicator: "HMAC"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "Aes192" (Indicator: "Aes"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "ECDsaWithSha2" (Indicator: "ECDsa"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "TRAILER_SHA512_224" (Indicator: "SHA512"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "EncryptionECDsaWithSha224" (Indicator: "ECDsa"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "RC2_64" (Indicator: "RC2"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin") Found reference to "TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384" (Indicator: "SHA384"; File: "feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin")27:Ta3a,">) at 2549dc1f259917a6179f726de0ed45e7-60001d3-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardLayout(System.Int32) at 2549dc1f259917a6179f726de0ed45e7-6000980-KeyboardNativeMethods~GetActiveKeyboard","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\" HTTP/1.1 200 OK\nDate: Sat\n 27 Jun 2026 13:24:14 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 945\nConnection: keep-alive\ncf-cache-status: MISS\nAccept-Ranges: bytes\nAccess-Control-Allow-Origin: *\nServer: cloudflare\nCF-RAY: a124c5576b487af7-SJC\nalt-svc: h3=\":443\"; ma=86400 with response body ==>7B0A20202020226970223A202236342E3132342E31322E313632222C0A202020202273756363657373223A20747275652C0A202020202274797065223A202249.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\" nuldel /a /q /f \"\" (Indicator: \"ping -\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"), Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\ndel /a /q /f \\\"\" (Indicator: \"ping -\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")\n Found string \"@echo off\\r\\nchcp 65001\\r\\necho DONT CLOSE THIS WINDOW!\\r\\nping -n 10 localhost > nul\\r\\nstart \\\"\\\" \\\"\" (Indicator: \"ping -\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$39","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$3a","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginConnect\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndConnect\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_Connected\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"BeginReceive\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"EndReceive\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Connect\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed namespace \"System.Net.Sockets\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed namespace \"System.Net.Security\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed namespace \"System.Net.NetworkInformation\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.18\"\n \"1.3.132.0\"\n \"2.5.1.1\"\n Potential IP \"2.4.8.1\" found in string \"2.4.8.1+cce1c58590\"\n \"2.4.0.0\"\n \"1.9.0.1\"\n \"1.4.1.0\"\n \"2.5.4.5\"\n \"2.5.4.72\"\n \"2.5.29.9\"\n \"2.5.29.14\"\n \"2.5.29.16\"\n \"2.5.29.20\"\n \"2.5.29.21\"\n \"2.5.29.23\"\n \"2.5.29.24\"\n \"2.5.29.27\"\n \"2.5.29.28\"\n \"2.5.29.29\"\n \"2.5.29.30\"\n \"2.5.29.31\"\n \"2.5.29.32\"\n \"2.5.29.33\"\n \"2.5.29.35\"\n \"2.5.29.36\"\n \"2.5.29.46\"\n \"2.5.29.54\"\n \"2.5.29.56\"\n \"2.5.29.55\"\n \"2.5.29.60\"\n \"2.5.4.6\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.12\"\n \"2.5.4.3\"\n \"2.5.4.9\"\n \"2.5.4.7\"\n \"2.5.4.8\"\n \"2.5.4.4\"\n \"2.5.4.42\"\n \"2.5.4.43\"\n \"2.5.4.44\"\n \"2.5.4.45\"\n \"2.5.4.15\"\n \"2.5.4.17\"\n \"2.5.4.46\"\n \"2.5.4.65\"\n \"2.5.4.16\"\n \"2.5.4.54\"\n \"2.5.4.20\"\n \"2.5.4.41\"\n \"2.5.4.97\"\n \"1.3.36.8\"\n \"1.3.1.1\"\n \"1.2.2.1\"\n \"1.2.2.2\"\n \"1.2.2.3\"\n \"1.2.2.4\"\n \"1.2.2.5\"\n \"1.2.2.6\"\n \"1.3.36.3\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"org.bouncycastle.asn1.ua\"\n Heuristic match: \"org.bouncycastle.math.ec\"\n Heuristic match: \"org.bouncycastle.crypto.ec\"\n Heuristic match: \"org.bouncycastle.asn1.gm\"\n Heuristic match: \"org.bouncycastle.math.ec.custom.gm\"\n Heuristic match: \"org.bouncycastle.crypto.io\"\n Heuristic match: \"org.bouncycastle.utilities.io\"\n Pattern match: \"https://ipwho.is/\"\n Pattern match: \"https://stackoverflow.com/q/11564914/23354\"\n Pattern match: \"https://stackoverflow.com/q/14436606/23354\"\n Heuristic match: \"ipwho.is\"\n Pattern match: \"https://api.ipify.org/\"\n Pattern match: \"https://stackoverflow.com/q/2152978/23354\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0\nHost: ipwho.is\nConnection: Keep-Alive\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"wh-tide.with.playit.plus\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: c12f54a3f91dc7bafd92cb59fe009a35\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://ipwho.is\"\n Found HTTPS url \"https://stackoverflow.com\"\n Found HTTPS url \"https://api.ipify.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"wh-tide.with.playit.plus\" (2 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://ipwho.is/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"ipwho.is\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.66.175.107\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"b__4_0\" (Indicator: \"winscp\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")\n Found string \"WinSCP\" (Indicator: \"winscp\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")\n Found string \"SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions\" (Indicator: \"winscp\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")\n Found string \"SOFTWARE\\\\\\\\Martin Prikryl\\\\\\\\WinSCP 2\\\\\\\\Sessions\" (Indicator: \"winscp\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed function \"get_ProcessName\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"\n Observed function \"GetProcessById\" in \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 2549dc1f259917a6179f726de0ed45e7-600003d-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"

[Esc]

\" (Indicator: \"[esc]\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")\n Found string \"HostName\" (Indicator: \"hostname\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")\n Found string \"hostname\" (Indicator: \"hostname\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")\n Found string \"'name' is not a HostName string\" (Indicator: \"hostname\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")\n Found string \"/K CHCP {0}\" (Indicator: \"chcp\"; File: \"feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: feea6bd8a190f0820c19df24b870a205d5799a9c75ace8044542496650a91ef0.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a3fcedf9caa030cf80beb31"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"