I checked just in case in a virtual machine to see if the archive was good to run and well through
Hybrid Analysis in a controlled sandbox environment, and the results indicate it as a
high-risk malicious file.
The dynamic analysis showed typical malware behaviors:
- Virtual environment evasion – tries to avoid detection in virtual machines.
- Registry modifications – can alter Windows registry keys, which is commonly used for persistence.
- Process creation/modification – may attempt to establish persistent or elevated processes.
- DLL injection – injects code into legitimate processes, making detection harder.
Techniques detected (MITRE ATT&CK)
The sandbox mapped 253 indicators to 134 techniques and 12 tactics, including:
- T1592.003 – Firmware information gathering
- T1106 – Native API execution
- T1559 – Inter-process communication
- T1059.003 – Windows command shell usage
- T1569.002 – Service execution
- T1129 – Shared modules
- These are commonly associated with advanced malware, trojans, and remote access tools.
Even if in virus total it looks like a false positive because zillya is not the greatest one
You must be registered to see the links
View attachment 5219745
The results of hybrid analysis
You must be registered to see the links
View attachment 5219776
I do not recommend to
run this file on your main PC. Even if antivirus doesn’t flag it, its behavior indicates it’s malicious. Investigate only in a
sandbox or virtual machine.
Because based on the Hybrid Analysis report, the file could:
- Establish persistence
- Modify Windows registry keys or create services so it runs automatically after reboot.
- Execute code in other processes
- Uses DLL injection to hide inside legitimate Windows processes.
- Run malicious commands
- Executes commands through Windows shell to manipulate the system.
- Communicate over the network
- Potentially connects to external servers (could download more malware or send data).
- Other advanced malware actions
- Gather system or firmware information, potentially open backdoors, or install additional malicious modules.
While I have tried to interpret the data accurately, I cannot guarantee that it is 100% correct, im not a malware expert so i hope that somebody double check what i just said o7
Also I used the file in GoFile link pinned in the OP to run the tests