← Back to malware index
Hidden Bee
Attributions are based on open-source threat reports. A family appearing here means at least one syscall record cites it; absence does not imply non-use.
3 syscalls cited
- NtDuplicateObject
Duplicates a handle from a source process into a target process, optionally adjusting access or closing the source.
- NtCreateDirectoryObject
Creates a new directory object in the Windows object manager namespace.
- NtOpenDirectoryObject
Opens an existing directory object in the Windows object manager namespace.