hxxps://login[.]microsoftonline[.]com/common/oauth2/v2[.]0/authorize?scope=openid+profile+https%253A%252F%252Fgraph[.]microsoft[.]com%252FUser[.]Read&prompt=none&client_id=8df89043-6847-4edf-b67e-2c22300d8cf5&uri=https%253A%252F%252Fdeveloper[.]bnisecurities[.]com[.]sg%252Fsession%252Fsession%252Faccount%252Fvalidate%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder[.]Decode%250A%2509Session+%253A%253D+MailFlow+%255B+DataStream+%253A=%2520Secret%2509Buffer%2520%257C%2520Message%257Dloop%2520Vector%253A%253DDataBuilder+;+DataContext+%257D+Flow%250A%2509Encode+[.]+SignalVector+%257B%2520Index%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053eint%252BVector-Key%25250A%252509Decode%252B%25253B%252BPayload%25250A%252509Hash%252B-%252BContext%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Index%252B%25252B%252BEncoder%25250A%252509Handler%252B%252528%252BSecret%25250A%252509Hash%252B[.]%252BSecret%25250A%252509Context%252B%25257B%252BSecret%25250A%25257D%25250Aelse%252BEncode%25252CEncoder%25250A%252509Stream%252B%25253A%25253D%252BBody%25250A%252509Stream%252B%252526%252BData%25250A%252509&state=424e4920536563757269746965737c656477696e2e6368657740626e69736563757269746965732e636f6d2e7367&Buffer%252B%25253D%252BParser%25250A%252509Buffer%252B%25257C%252BBuffer%25250A%252509Token%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CBuffer%25250A%252509Data%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BEncoder%25250A%252509Buffer%252B%25257C%252BParse%25250A%252509Key%252B%25255B%252BBuffer%25250A%25257D%25250Aint%252BContent%252529Buffer%25250A%252509Stream%252B%252528%252BFlow%25250A%252509Buffer%252B%25257B%252BContext%25250A%252509Buffer%252B%25252A%252BData%25250A%252509Buffer%252B%25253B%252BKey%25250A%252509Buffer%252B%25252A%252BPayload%25250A%252509Hash%252B%25253B%252BTrace%25250A%252509Flow%252B%252529%252BTrace%25250A%25257D%25250Aint%252BSecret%25257CSignal%25250A%252509Header%252B%25255D%252BStream%25250A%252509Payload%252B[.]%252BKey%25250A%252509Buffer%252B%252528%252BSignal%25250A%252509Buffer%252B%25252C%252BBuffer%25250A%25257D%25250

Sharing

Behavioral task

behavioral1

Sample

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=8df89043-6847-4edf-b67e-2c22300d8cf5&uri=https%253A%252F%252Fdeveloper.bnisecurities.com.sg%252Fsession%252Fsession%252Faccount%252Fvalidate%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Session+%253A%253D+MailFlow+%255B+DataStream+%253A=%2520Secret%2509Buffer%2520%257C%2520Message%257Dloop%2520Vector%253A%253DDataBuilder+;+DataContext+%257D+Flow%250A%2509Encode+.+SignalVector+%257B%2520Index%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053eint%252BVector-Key%25250A%252509Decode%252B%25253B%252BPayload%25250A%252509Hash%252B-%252BContext%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Index%252B%25252B%252BEncoder%25250A%252509Handler%252B%252528%252BSecret%25250A%252509Hash%252B.%252BSecret%25250A%252509Context%252B%25257B%252BSecret%25250A%25257D%25250Aelse%252BEncode%25252CEncoder%25250A%252509Stream%252B%25253A%25253D%252BBody%25250A%252509Stream%252B%252526%252BData%25250A%252509&state=424e4920536563757269746965737c656477696e2e6368657740626e69736563757269746965732e636f6d2e7367&Buffer%252B%25253D%252BParser%25250A%252509Buffer%252B%25257C%252BBuffer%25250A%252509Token%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CBuffer%25250A%252509Data%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BEncoder%25250A%252509Buffer%252B%25257C%252BParse%25250A%252509Key%252B%25255B%252BBuffer%25250A%25257D%25250Aint%252BContent%252529Buffer%25250A%252509Stream%252B%252528%252BFlow%25250A%252509Buffer%252B%25257B%252BContext%25250A%252509Buffer%252B%25252A%252BData%25250A%252509Buffer%252B%25253B%252BKey%25250A%252509Buffer%252B%25252A%252BPayload%25250A%252509Hash%252B%25253B%252BTrace%25250A%252509Flow%252B%252529%252BTrace%25250A%25257D%25250Aint%252BSecret%25257CSignal%25250A%252509Header%252B%25255D%252BStream%25250A%252509Payload%252B.%252BKey%25250A%252509Buffer%252B%252528%252BSignal%25250A%252509Buffer%252B%25252C%252BBuffer%25250A%25257D%25250

Resource

win10v2004-20260911-en

windows10-2004-x64

9 signatures

150 seconds

discovery

General

Target
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=8df89043-6847-4edf-b67e-2c22300d8cf5&uri=https%253A%252F%252Fdeveloper.bnisecurities.com.sg%252Fsession%252Fsession%252Faccount%252Fvalidate%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Session+%253A%253D+MailFlow+%255B+DataStream+%253A=%2520Secret%2509Buffer%2520%257C%2520Message%257Dloop%2520Vector%253A%253DDataBuilder+;+DataContext+%257D+Flow%250A%2509Encode+.+SignalVector+%257B%2520Index%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053eint%252BVector-Key%25250A%252509Decode%252B%25253B%252BPayload%25250A%252509Hash%252B-%252BContext%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Index%252B%25252B%252BEncoder%25250A%252509Handler%252B%252528%252BSecret%25250A%252509Hash%252B.%252BSecret%25250A%252509Context%252B%25257B%252BSecret%25250A%25257D%25250Aelse%252BEncode%25252CEncoder%25250A%252509Stream%252B%25253A%25253D%252BBody%25250A%252509Stream%252B%252526%252BData%25250A%252509&state=424e4920536563757269746965737c656477696e2e6368657740626e69736563757269746965732e636f6d2e7367&Buffer%252B%25253D%252BParser%25250A%252509Buffer%252B%25257C%252BBuffer%25250A%252509Token%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CBuffer%25250A%252509Data%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BEncoder%25250A%252509Buffer%252B%25257C%252BParse%25250A%252509Key%252B%25255B%252BBuffer%25250A%25257D%25250Aint%252BContent%252529Buffer%25250A%252509Stream%252B%252528%252BFlow%25250A%252509Buffer%252B%25257B%252BContext%25250A%252509Buffer%252B%25252A%252BData%25250A%252509Buffer%252B%25253B%252BKey%25250A%252509Buffer%252B%25252A%252BPayload%25250A%252509Hash%252B%25253B%252BTrace%25250A%252509Flow%252B%252529%252BTrace%25250A%25257D%25250Aint%252BSecret%25257CSignal%25250A%252509Header%252B%25255D%252BStream%25250A%252509Payload%252B.%252BKey%25250A%252509Buffer%252B%252528%252BSignal%25250A%252509Buffer%252B%25252C%252BBuffer%25250A%25257D%25250
Sample260930-bv4kaswhle

Sharing

General

Malware Config

Signatures

File Explorer