Extended hh.exe in Office Shell detection

https://www.hybrid-analysis.com/sample/6abc2b63f1865a847ff7f5a9d49bb944397b36f5503b9718d6f91f93d60f7cd7?environmentId=100
2017-08-04 09:18:26 +02:00
parent 36212fd5c2
commit edb52e098a
1 changed files with 1 additions and 0 deletions
@@ -23,6 +23,7 @@ detection:
            - '*\sh.exe'
            - '*\bash.exe'
            - '*\scrcons.exe'
+            - '*\hh.exe'  # see https://www.hybrid-analysis.com/sample/6abc2b63f1865a847ff7f5a9d49bb944397b36f5503b9718d6f91f93d60f7cd7?environmentId=100
    condition: selection
 falsepositives:
    - unknown