Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
xx exo.rar
Resource
win10v2004-20260130-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
xx exo.rar
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target xx exo.rar
- Size 25.1MB
- Sample260506-bdybysgz31
- SHA256 4ca92012a23ae750da0f94b1bd3af10fe102aeed420a035bee2db92d67dc0e55
- MD5 ca0798f5c487b073031ccaa14054a42a
- SHA1 8008a935203f2ff3dd31ce22b20eeef9272ae628
- SHA512 bfc5bb4c8ca32ad93bb042af4b40e826483877aa648f48a8985720bfd27dd81062c926e45d8a62ba5c0a9914edf9dacb69c820b83bbe953fedc08a68f872a101
- SSDEEP 786432:q3uNSaVQNQpjnPqH0dI8nedzaomWhpa7VfeSr:WGSaGEnP20dIAyc7VfZr
- TLSH T18F4733D09C3742B9DFFAA59D841CE214EFB7178562BB8F012B3BD65DD620DB92005AC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2564 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2564 7zFM.exe Token: 35 2564 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2564 7zFM.exe