edd7444ef7a7a00689762774cedc0eb4133b64fa383a863eaa5a9309e2176971

Analysis

max time kernel
149s
max time network
99s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 14:21

Target
NXOLoader.exe
Size 8.9MB
Sample260525-rn3mesdz7x
SHA256 edd7444ef7a7a00689762774cedc0eb4133b64fa383a863eaa5a9309e2176971
MD5 a1086a8f4bda4e7d324c58262f749d9d
SHA1 a4d81b1a90f2d41e8a02612df968a16a70ec5b49
SHA512 d69d11e94bdcc2976d2d10231ce1dc106b493464d4a018d834555d3f9bc37deac593c969cf0ceea1beba89b6fb27c80e9296a0742c939abca90962811c084a48
SSDEEP 98304:bPZ9mPj2qcu1ewVtjevaHLf9TzF7RVFNV3pRUwRXINns5hUOdduH85XiNNRWQUED:bPZkKy1ewVtFhzF9NTLAnBV8i5IIg
TLSH
T13B9623BFE75DAB79C44212B4E842C2F774A09C45029E5DA0339B7E41F5538AB084EFE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3052	NXOLoader.exe
3052	NXOLoader.exe

C:\Users\Admin\AppData\Local\Temp\NXOLoader.exe
"C:\Users\Admin\AppData\Local\Temp\NXOLoader.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3052

memory/3052-0-0x0000000140130000-0x00000001406E8000-memory.dmp

Download