Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
02/12/2024, 16:10
General
-
Target
tmpfile-main/Hybris_ZeroHackSafe.exe
-
Size
5.2MB
-
MD5
0e588abf4f1ca1d91047449253e6b7ce
-
SHA1
ebb7342e345cea5e68a2ad7112de465586921796
-
SHA256
e073c4d9b3995dcc33e8fc33e9c02af527c70937b1c946397c83bacfbed065af
-
SHA512
06fa2d3d20b916d8fa652df970a382cdbaa508ba458272e4b26e135ec3d051b89faa4541540e7d348c605618897439a27e25d94f30818c3f08839538128888b9
-
SSDEEP
98304:vFiIUy06zTw91KS5WAV04eN/oEMqUKucAXix9msJcszLn:vFhU91KS3e4e+EMqU1MECcsX
Score
7/10
Malware Config
Signatures
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpfile-main\Hybris_ZeroHackSafe.exe"C:\Users\Admin\AppData\Local\Temp\tmpfile-main\Hybris_ZeroHackSafe.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8.7MB
-
Filesize
3.4MB
-
Filesize
8.7MB