207bfa95050e2ac1f16ceecd5891b93eda7bada2730b4e7172283d72f5ad2309

Resubmissions

22/07/2026, 22:03

260722-1yjrqs1xes

22/07/2026, 22:01

260722-1xp75acf535

Sharing

Copy URL Twitter E-mail

General

Target
t-rex-0.26.8-win.zip
Size 38.4MB
Sample260722-1xp75acf53
SHA256 207bfa95050e2ac1f16ceecd5891b93eda7bada2730b4e7172283d72f5ad2309
MD5 48fc408e5c758aabba5b25bab9efd567
SHA1 cda73245b633eab32823bfa02e3a161457491a06
SHA512 0ebee55325ce2e2d4fcd9e3de7061816bed5a575a3ca39cbaa0848104a051b559d9ffebfe778ce83c5f0ff88a5593772073e5f758487c0ca6b3b495640d2ad62
SSDEEP 786432:dzdyHYyWqJNk2uDHf1Q+qBS7q0+JYugACoMr7S+Z168C/dnqDL2Jtc2H:dJyH+q0BLK+coq0+eUga+q8CVnqPs3
TLSH
T1B397136A62A802ECD07BC07CD917A903E7B1741B03B09BDF26D999A61F576F05E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Targets

- Target
  ALPH-herominers.bat
- Size 154B
- SHA256 025602585fec10119c8ee115715ee6d86e34ce7c5cc3dd7e3930efdc2027cd1a
- MD5 59d222706ddfb61388df64cb198e67d7
- SHA1 a45166df41d31c54ba8851342aa8f9e7714f227a
- SHA512 c0f99434fbc596120e4f4e858f172da28f134e6a39b7c3ad1c0129b71840084120768a03922f72c4020ecea3afc883919c3f9dabc372b33e47825e1b3b885521
- TLSH
  T179C08CBA8B68023AB5D54504A89A2D8CEA0C4A82E62B0910BD292275F48A49C6F140CA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  ALPH-woolypooly.bat
- Size 147B
- SHA256 52038c702029d2a9274c2013ab30ba0f5579927d2f5925e2f3b8b9626c891d92
- MD5 9f675d5f29e26eb8680c96916acbb9c5
- SHA1 127f681651e62c797d44972f19a9d7080e25e172
- SHA512 b33ac1db3e551f9257a30cdf8381e939547f3edfe4507458af1b85dde78d9b6acea79e5bae94df9300cefd43f76011f642cf90528601f034cb4a47153957b562
- TLSH
  T178C02BBF8B7400B6B5C4414480255C0DFE0C87C1D57B1A21BA1C2374F89F05D4F140C2
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  CFX-nanopool.bat
- Size 164B
- SHA256 61df4f4bd7d4ea06142382777139ab88673a37f39b339f5344ae8ff4b0615ebf
- MD5 0f44d2da16070ff57bd726a9e33efa1b
- SHA1 52280ed9921b61912810fe0c268b0468b5149d6e
- SHA512 a962e0ec36893839017ec891356689b05db3bd0d9fd13ea1b071a03457630ec969fdef790360b99cfe782683f7e5f27f79ee61124f95f239c154621cbe50ea4e
- TLSH
  T14CC0C03C85D43C30C0930940237C601DCD58B080C4300558704D88FF381B4282120ED5
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3
- Target
  CFX-woolypooly.bat
- Size 147B
- SHA256 0cdd23a0ead1ac9c4c944a813264e0f0f86d8198803b5b27656d67364f39b753
- MD5 42f42b3da60222e95a7fac0155a99bd6
- SHA1 e2f43df4e34e1f08e7658c63d7253322e9c70c68
- SHA512 c3731d3c656395232a1f18c7e1fdffc20fee352a5deaeb8355796409ea69fb62643d6b9fce78a9eee1a5b75a0bd9432ed54ea57ba1683a4a2af2b438a16b2a3b
- TLSH
  T1F1C08C3695E51830258019C541782A9EDC98B5D0C42186EAB54C46A63A0F869A2309C6
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral4
- Target
  ERGO-2miners.bat
- Size 151B
- SHA256 6f432163d91d83695f58b03b4d8a681a952de2c840062bd94d632353b969e44f
- MD5 6e06e5f220bd5a56bf63b75b4c64047f
- SHA1 37a688c3e1570ff7e69192840f63a15cdacca47f
- SHA512 ead3d5d2bb0dc2dbd785ba42aa7669d4824e3e477a5d1597f84e1dd7562938736f7370cc102e5f3b0855a67ec53042aa7b3cd43f89395375419c4c42281cc8d2
- TLSH
  T1EBC08C9B8B7A0279BBC1048A4936B00ECC495042D619494037690308AA1B69856602DA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral5
- Target
  ERGO-herominers.bat
- Size 158B
- SHA256 6b08f31cbe90d19b68249e41a79a7a8e7e0fd27c8f7cc8f217ab8fb6068e6acc
- MD5 194f3627144b5d93662635f68e428dae
- SHA1 af6234cdafa190e0d7d9b77ada1ef2eec1234d6d
- SHA512 67e3262fac39ae810e11d7e9557182f477e23e8c1c79583503dd39644f38b3a65ce8546d62562e70343ee7e0f5b0cfb4e613d79c96041c546d9487c5f3ca4bf5
- TLSH
  T1D7C08C8B8F3A037ABBC1488A5936B00ECC8E1041D6298D10366D1318BA1B9DDA3A40CE
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral6
- Target
  ERGO-nanopool.bat
- Size 173B
- SHA256 cb5c18094f11a04ad69f2d565f2d29c18b67259225c95b8cdfa46564912eb217
- MD5 968c2e55027eeeb7f0e0e67872ef7a5f
- SHA1 9e4a5287ce3814b3a09577eed68cfe52051e75c5
- SHA512 d40f9d372d2cc7c0e907dd90e5d7f34f0aacf367f52337c27c3ccbbfa8a0cd60b981a1b9ddeb29d29e61a5a6605d02c1dcfd27c51eead3ad259a2d8704142748
- TLSH
  T12DC0C0BA8E6824B06BC004661735E00ECD460040C224091432CF821D443B04843101CD
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral7
- Target
  ERGO-woolypooly.bat
- Size 155B
- SHA256 a0933d17c5e939be79b5b38e9b98a9b4b1a64cac186205fa5c9c9a9528051fea
- MD5 0e7eeedcf2dcd2763521269986d31e82
- SHA1 c6dbde1394ed4ea0da6eea01894d8d5b53a4e1e9
- SHA512 50c184190ab1cec364810b00307340881b91240d235902485018db80c71771ee99a719c83999db7272962e981f8657c45dc6acede1160d679766262feb779e05
- TLSH
  T1DAC08C5B9B3901B47BC0048A8536A90ACC8A5180E1595AA633591308AA2F19943A00CE
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral8
- Target
  ETC+ALPH.bat
- Size 277B
- SHA256 c562f42bbb7db6bbeef806e668d0ae8a19634c9887a73314889547c4b1e19bf1
- MD5 ee6547a93a2e68fb3754f3d3f5de7b8f
- SHA1 6fa75502d75e7f766f4981acb57d861a4b8f82a1
- SHA512 2a3ff6109e1b65b5064491ca135ab51b5d7135ebf7dfdc57a053ff5acb59ba98b0157c90afc59fbb53b10d67a9988e9c290d1a693fc9654b7e5e9d2b3882addc
- TLSH
  T12AD02B5EDF74177AF4DD0904B59B3C0CC90C1546F66A8E045D3C4725F5050ECAD340CA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral9
- Target
  ETC+ZIL-ezil.bat
- Size 308B
- SHA256 72cf891570d14961f7ccf5d3b05aa500a34141cba191cf5b8fad2753d7eb2da3
- MD5 c11670ad128dcabf31433e690132942f
- SHA1 47a3118224750fe077d52b9c881f3a78840a39a4
- SHA512 0ad0c62b700a8f5b83707b60b1488d4aff98b3ff8401b6ea9c64fd04b69512d1ce6c064da726480409a03bbe0dc2214b14f48cc4289af5621ae29b726352d3ac
- TLSH
  T13DE07D4EDA2706B0E01D5D8537A2540DC9991103A928FE1EB85C4503E209018D5748DA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10
- Target
  ETC-2miners.bat
- Size 142B
- SHA256 74b0898a3960434ee46bdfd6d4657924a43be7386424889bb4ce7db908ade3b0
- MD5 297b19c511712ae647cd045f808a7f51
- SHA1 b2d744ce70ec00d63e4cf16dac80f41b7e5fc348
- SHA512 6e29a8b33e050883b4b34b869f25ab897bf3b8b141da4bf5ed01924afb05bfe1a04c6bc3ad71a51e7b4ba3ed27e690491c7d6237eb0d74de06f17f50da81d29f
- TLSH
  T1DFC02B5EDE352575E05E094572233C0CC84D1002E0395B012D2C0519F9044DCDA344C9
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11
- Target
  ETC-ISP-hidden-mode.bat
- Size 184B
- SHA256 3e14e2dc6a55f9e872ddb19f4458bafce8f209caa693e10f1481328d6c578a07
- MD5 644d1d193db37cf645e26baf8e10a9f5
- SHA1 ea1d82215cdff3cd1b9c25c40906ea6ec0da319b
- SHA512 02dcdd26058cd338b6cb03a94cbab7583b0cbb9a4c1ca89d9abc680dc7e952c0a0662f50f1cbcf46cbe0a29740baa6304972f5ab3a7aba4f513fb8fc21115164
- TLSH
  T118C0C0AFCF1985BDE04D09C636713C0CCC1D0002E1303D013EAC4A0EB40506CD930481
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral12
- Target
  ETC-woolypooly.bat
- Size 147B
- SHA256 c1179f13962393f31f13d4e1995d36dc7815e0d2293c46da6b944d0fc24417a3
- MD5 871bac3f910667de91deb7cebd1fa2fe
- SHA1 3a632647b35c96e74633bd08e411d3d05a97a8f7
- SHA512 ece4568d19070dad507f703782ac6b702a5d48ebc098d05e23a5d50b468f7386fad3470a04aac12beee1bdd73d0f70408c7bcd47a4d8155e4551932daf75ca51
- TLSH
  T1D2C02B2FDA3514F0F0480AC8A2326C0CCC8E5141F0366B672A1C0925F40D09DDB344CA
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral13
- Target
  ETHW+ALPH.bat
- Size 277B
- SHA256 394c5d5b4b61aff9f54145b728782a7009cefb03b83fc765988dc37cd5802f6a
- MD5 a551bd69b67f86d9385726fb914a6cd3
- SHA1 282fcbf71fae40d10bf8ebc4f1767fef1ab96885
- SHA512 a76c08b3a2616846ef65d76decf4c6e417a57a29365f1ad024a2c31d3c31ac9ae85542367a5649d53afc58ceaf50e022fd89ba9eaa7beb3d5e9165053013f271
- TLSH
  T1E3D02BAACFBC073AB5CD5604B4492D0DDA1C1745E67F48506F7D8B21E01A4DC2D244E5
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral14
- Target
  ETHW+ZIL-ezil.bat
- Size 302B
- SHA256 e030d9629b4ede1b1cea8d19ac26958d5bbc68ac5bb6f7bece8f0b7c7f6505ab
- MD5 058c40dff0c8cf81d03a8d2c743a06fb
- SHA1 2c16408fb7997ab48cd93b03ba57d1eb484e49a1
- SHA512 02f85e7b5f37e52614fe8769364d30a67a1218d8becff3ff4aa1c23000f89ab7e21b2544db9d346bd366e60de6bc8e1fa0baef2e10aed7db7d9a0b6770a6c9df
- TLSH
  T1C0E07DE98AAE0235E00E5645785041169B7C0707967D50E8BB1D891281294001574CF4
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral15
- Target
  ETHW-ethproxy.bat
- Size 77B
- SHA256 ca5f8b2b53eb90262156507e13d49dd3b22f47ccffb8b7cd427c1d28a8cf6d81
- MD5 2d979cfc95c6a20e03b679240d0a761d
- SHA1 56b4e450a1584df0a6df666e1df6bb0e59923a13
- SHA512 b1c6fb5dc0d8034b7174bbbd2600506379ccbb9ea35dfc432ec090243a64f4d52f38ad152f4c764b5a3029d571bd65c924fff46f9a8f06f15853b32b3cd6cac7
- TLSH
  T168A0245C073D0054C31F4D0C3031705DCC0DD000F0550400350D15141C15C041F340C1
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral16
- Target
  FIRO-2miners.bat
- Size 132B
- SHA256 f1c8c7bb0a9264410f3e13aa37f414834e246e1edc67813a348ec51375909981
- MD5 ab9a8db5bab6110f594d4cbbe7b5dbce
- SHA1 a6f3f5f1632249177457f30eb09452521b7e0755
- SHA512 f84b97a3a5cb8a8b14299aebb96a23dcadbe0fc93db5063a9410649cc04f19e9396097df961cf8bdae5186424a32ea710f7b85bc9440103b9864d2d1337c9ff8
- TLSH
  T1A3C02B3A07380E38A0A0190C2436344CCC0C148BD63609A076CC520CFC1644C71E04CC
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral17
- Target
  FIRO-mintpond.bat
- Size 133B
- SHA256 9249b57a57638e3f6fcba7b911400b8b714b06ee86763d8791a0f39faa25505e
- MD5 524f4eec99dd37fd721ef8f6405c1005
- SHA1 1b45a12f317ef6cc3f264a69f29a74676a4cba22
- SHA512 e80851f3d6524ae895fc0474eecb6d3f2a8c09b4dd08441a569347c9259e41fbed64b438fa25d067be013182b24836a095fe022bcd33b6460c7987745deb4131
- TLSH
  T10CC02B2907B84834644C09080039544CCC1D659BD1B90870614C5248FD3E80CF5A04CC
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral18
- Target
  FIRO-woolypooly.bat
- Size 135B
- SHA256 82c56e0f019d3131c6e800fad4db24f384982fb07896f026b723d304655e83f2
- MD5 5e1739d84353e352a2b43ac2c40f521b
- SHA1 b04adb2f122f2337a74316693c13afb247dc1fb4
- SHA512 91090d0c24af2df36fcd1b5675ab6861792b518388a8d7f4245ba2293404a1034e0bd4aab9257aed4fe93a059bfc533894ec9a15667d29016451ae68083f2ae7
- TLSH
  T1A9C02B1B037C48B47080094C80345C4DCC0E55C9E67116B2734C5144FC2F00D72A08CC
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral19
- Target
  RVN-2miners.bat
- Size 129B
- SHA256 74f022dd11b333b7561bf7e0e83b896308d360561f5b6f1efe3ba37ba86b7d2c
- MD5 50fe4021d80c450267d7534a9ab108e3
- SHA1 489d2221c9d63ae2e31ab24386f395f651c87aab
- SHA512 96a0081e901ab59bce9903d64d90a6e1c91fca6f9b99ac00094287faa1ced4619ff0a191e0e7892832695cc7b88dd51d39f6591b7a953ce1c797f65e8af3619d
- TLSH
  T1C9B02B2E29302334A1634E043430788C980E7429D122840CA29CA8A8381840EB1080C8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral20
- Target
  RVN-ravenminer.bat
- Size 136B
- SHA256 e7907b17cb799f31e6b24606f1c73fcb346504c027c65dd8be09bab740907aa1
- MD5 2e61d95e696a404b501ee30dfc0a9309
- SHA1 af3f3259bf6ee89c84a164565ce1c4e0a3bfb6ca
- SHA512 d96f8206c6549dc733d6e146b4a0cb2adb7cab768534b71966cd8fc2299d31a76166b32dc2fba8bd3f7460b275e19d8381a90f49730d88b7fbc6acfe9741d467
- TLSH
  T16BC02B3E3A31137060084F0864309C4CDC0F79A9D126802CB38CC839141408572645CC
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral21
- Target
  RVN-woolypooly.bat
- Size 134B
- SHA256 1a6c815acb5018ce48151405c12b04350114da0cef0a6a7aca071c30857eda41
- MD5 1f71377da201f9d5b449c568185c8d27
- SHA1 1909dde994df8f10e27098cb8b4da86c73f4c9fa
- SHA512 30e0e448da5f81048cffa6a853e8fec7bc0a25d80b79b69917a5b958bf08c3c876c2db409b2b774fe3e6092f54acef0dc2f31f4a43ae2f9f7b77d7133d91a918
- TLSH
  T142C02B3F613052F0B0114E8860307C4CFC0FB0B8E112812DEA9C8C28242D00A72084C8
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral22
- Target
  SERO-serocash.bat
- Size 243B
- SHA256 46b1ae16c968835e9a11199c4b0c198cabf1b3b38710faf2ec366072f310a946
- MD5 862a47163ef1ae825fc7b9ff9ca4d9e8
- SHA1 c366eba8db79de0cb6aff098131ab66873e24956
- SHA512 29198cc69d64a43cc20c405b8753b219b75bf056322831eadd162a9b4f8fcf6baa0c9abef29b3e0a4fe789af138c068e96746177f2463022afafd36e8aeb47ef
- TLSH
  T163D095FD46565531109C4824A5787C9DDD04E443D74120721E17217534DD5AC4110680
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral23
- Target
  VBK-reb0rn.bat
- Size 144B
- SHA256 590867302929076c048deb326b9797d7332b2705299d0ea8b5d8b4767f8c736b
- MD5 58c139df84d21c1b1296d3efae4abc8b
- SHA1 415c7d9f3738d84aaaf4605e4022a73079816f32
- SHA512 b0974884c72bf85cb9c2a6f8e255a2c59c6723adc8eb3dc6e80ca6a532ed5b526012f7979c05e9645eab6805ed05de9811129f8076d2bf5ce678670321970c78
- TLSH
  T14EC02BCE292BF07CC0822C40803DA80DCE4C348CC3222681BE0C52BAE46B57542034CE
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral24
- Target
  VEIL-woolypooly.bat
- Size 151B
- SHA256 16d26c7551154d60016b9f32ee2126205245f466c604dee38ae96dba84fe66fd
- MD5 5971716b4ae597b4d47aaaf29a0921a7
- SHA1 148b8478cf85b6a2b9f0da1671bd74e2e1f18545
- SHA512 ec3b64cedb93d0175770510c635826da54bd2debb73ef01f2a6efabdaa8773e67bc33c4f39900b9e5f433faac33e98aa66fceefe680cb48f94843ca52cfb5f36
- TLSH
  T17DC08CBA6B6F6034A24084489070CE8ECE48A0C28D6941FAAB1C556A682E68953011D6
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral25
- Target
  ZANO-luckypool.bat
- Size 211B
- SHA256 824ff1ded2aaa79208c4aff348c7debd7bcb380f480ed0176c5742c61078f6f9
- MD5 a6206d6c43c3ccdb04f526067f84f0a4
- SHA1 60ea11b42ccf2cfe0fae8cc096396319fe2d21d4
- SHA512 8a88b462bd540bfc37053241356e299921a54fa45b23b22bb8acb35642dd1c0247c872c55c6fe082d8eafb7278d60330819745e0b734f13bf277c0d06e92253a
- TLSH
  T112D0233A99C00834E280102464217E0FCEB930B0403305110B0D055EF8160C08610050
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral26
- Target
  help/FAQ.md
- Size 27KB
- SHA256 7d887d0f4de6ca66dd881527e86db713acc7fbbb913cebc3fb57dbf5db5f3bb8
- MD5 e93b1f88b4a405fe73d2e088f7432655
- SHA1 b4162b76ffa93305a220cae4afd7d7dbfba80c8f
- SHA512 0669a7ccbc35dafdeed41d93df7b972c7e5dac188447c02981d2214febb4c94240318328f898b2c53000aa37c3b286359abab0da8fff73f41d9cafca09b2424f
- SSDEEP 768:h+mY56ndzRmF1ufartwfBb1mPTwlxQneSmf:htcaqA1mclxqO
- TLSH
  T140C2E94F6747037602B103A27A1E63E2F306407D2B664636347D906C33B9EBA567B9DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  t-rex.exe
- Size 38.3MB
- SHA256 08e994aa4659a0fd4674d93ed9e683dff7c020013629e39d6ea73091f2bcd33b
- MD5 40532ea36c2d4de56522ecf707bf289e
- SHA1 86520c67e37b43366f965b63ba78070688bff83e
- SHA512 41df9cc910afe6ffe7f92e1e26b607cf7fea18f52a746ca97d532406401035b5bb3ac5ebcb9bc659d4125cbf7262383aefc1f03a01886dc71e268b52ac2b43ce
- SSDEEP 786432:vzdyHYyWqJNk2uDHf1Q+qBS7q0+JYugACoMr7S+Z168C/dnqDL2Jtc2:vJyH+q0BLK+coq0+eUga+q8CVnqPs
- TLSH
  T11097136A62A802ECD07BC07CD917A903E7B1741B03B09BDF16D599A61F576F09E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28