Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 23:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
____st____r-v.4.266.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
____st____r-v.4.266.exe
Resource
win11-20260513-en
2 signatures
150 seconds
General
- Target ____st____r-v.4.266.exe
- Size 2.8MB
- Sample260604-3vs74sgy7x
- SHA256 021e904f7e6b52aaae9bde641e71ee41d5c28698fdfd6612d5c472090f12b1ce
- MD5 435a9971e4c53de27734fabf34344f0e
- SHA1 ec8eacdb7a40b5b61c7ba1e44ff5280083cb3ad6
- SHA512 db43cc7345933d980815f6167f5317089cb6f310bd6276bf0a9a8bf77cf80ada44bdafcd660c155a3eed09d6f0fb2369f8b0f70c86137b4dd44326fd6a9557f9
- SSDEEP 49152:hQjeEPd2+cYm71Txicl5MvU1QWGEqtCp7+vwEnz:heyYCjMc1QWGE2Cp7+oEz
- TLSH T1BAD59D4BBCD444EAC1A993358EB39292BB75F8490F3293C73A51B6382EB67E05C35714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4992 ____st____r-v.4.266.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4992 ____st____r-v.4.266.exe 4992 ____st____r-v.4.266.exe 4992 ____st____r-v.4.266.exe 4992 ____st____r-v.4.266.exe 4992 ____st____r-v.4.266.exe 4992 ____st____r-v.4.266.exe