Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 23:00
Static task
static1
Behavioral task
behavioral1
Sample
xbinder.rar
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
xbinder.rar
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target xbinder.rar
- Size 455KB
- Sample261002-2zbcesxwev
- SHA256 79f9d693f02ad92939bc383acf5c80dff41b0feefd3cb66e06677490be9860c7
- MD5 d3c67fc9bdee441a4eab3e169209098b
- SHA1 b35a585aacfc577ea889412bb5f92247615171e7
- SHA512 bf247bc7dfca5a673e64a3cb35e8cbd59d667fdda0ad1bdec3b608a0eef1314d15c238bb7c16bccef860420a94a505efe4e4179628f7c2e3c12dff6bfad0ee13
- SSDEEP 12288:jX9ZlvPHglH8rDAniH3al0oKAnk79yrf+uUBJdl:jXD151HeCq2ovUbdl
- TLSH T1A7A4237EA25AC33E1137154A7C6946D274F3809C7BB2CA15261459FDB96B8AF08FF302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1948 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1948 7zFM.exe Token: 35 1948 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 7zFM.exe