Overview

overview

7

Static

static

7

svhost.exe

windows11-21h2-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svhost.exe

  • Size

    7.1MB

  • Sample

    240421-2r72escf4s

  • MD5

    a947a9e85a01ddbba4a6d4b500b40206

  • SHA1

    cea7e63b7c10d4eff1c22be36f93e55907ec9365

  • SHA256

    3157201d61d8092c6c989bf96f9e1199b07b2077ff3c1b4025feaa9cf1c4d903

  • SHA512

    d97df48058a2439605eb46b6800402e7d909b12383a18b679ffad3a58150aefa76c333c02d1334c20b918cca56a4ccfaec5dab3671575bf7cba7481010b564c8

  • SSDEEP

    196608:6Q7R35BJqyZrFRPXYFPOZOYaNzW/4y22:6Q7RJbq+XQslaD

Score
7/10
vmprotect

Malware Config

Targets

    • Target

      svhost.exe

    • Size

      7.1MB

    • MD5

      a947a9e85a01ddbba4a6d4b500b40206

    • SHA1

      cea7e63b7c10d4eff1c22be36f93e55907ec9365

    • SHA256

      3157201d61d8092c6c989bf96f9e1199b07b2077ff3c1b4025feaa9cf1c4d903

    • SHA512

      d97df48058a2439605eb46b6800402e7d909b12383a18b679ffad3a58150aefa76c333c02d1334c20b918cca56a4ccfaec5dab3671575bf7cba7481010b564c8

    • SSDEEP

      196608:6Q7R35BJqyZrFRPXYFPOZOYaNzW/4y22:6Q7RJbq+XQslaD

    Score
    7/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix

Tasks