Overview
overview
8Static
static
5zeroscript...ct.rar
windows10-2004-x64
7zeroscript...ct.rar
windows11-ltsc_2024-x64
1zeroscript...up.xml
windows10-2004-x64
3zeroscript...up.xml
windows11-ltsc_2024-x64
1zeroscript...rl.dll
windows10-2004-x64
8zeroscript...rl.dll
windows11-ltsc_2024-x64
8zeroscript....3.exe
windows10-2004-x64
8zeroscript....3.exe
windows11-ltsc_2024-x64
8Resubmissions
27/10/2026, 18:06
261027-wprzjae14z827/10/2026, 18:02
261027-wmew7awses827/10/2026, 18:00
261027-wljhzse12x8Analysis
- max time kernel
118s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
zeroscript_connect.rar
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
zeroscript_connect.rar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
zeroscript_connect/gup.xml
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
zeroscript_connect/gup.xml
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
zeroscript_connect/libcurl.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
zeroscript_connect/libcurl.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
zeroscript_connect/zeroscript_connect_v1.3.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
zeroscript_connect/zeroscript_connect_v1.3.exe
Resource
win11ltsc2024-20260911-en
General
- Target zeroscript_connect.rar
- Size 4.4MB
- Sample261027-wmew7awses
- SHA256 4b16c5ffdaacf108e514a5524c7eff9e843e45a24c75916772152da1f4bcb8a4
- MD5 17244237466589beeb122a0d6f00ceec
- SHA1 d56a51ae92fbc9950b41662fd8cd0f9a76f0a711
- SHA512 4651f9896a951526aa46c92d89166c950d1bb020fb9e8bac2171f07d10bc689e6c5f1ea9065bfd43dcf980fd237e0f3099b31bb5949648ff2690bec45e8cb75a
- SSDEEP 98304:ASQEoQGIYcPa/ptHwUm9TR5V48b8VTJFBQ6riQxE6V:7QEoQGIYeaxtQjdRJb8VHBjtxE6V
- TLSH T1F22633E0DB4D603457F44982B217DA7F8EBC8F5538BA2C18F91C058C54BAE0649EDB79
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1876 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 1876 7zFM.exe Token: 35 1876 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1876 7zFM.exe