🧰 attrib.exe

The items that name it 2

• Threat Actors Achieve Persistence After SQL Injection
  writeup2026-07-13

  Used by the threat actor to set file attributes (system, hidden, archive, read-only) on cryptocurrency miner files to cloak them.

• Trial, Error & Typos: Malware Isn't Always 'Sophisticated' | Huntress
  writeup2025-12-22

  Used to set system/hidden attributes on dllhost.exe (copy of agent.exe) in Incident 2.