027cc450ef5f8c5f653329641ec1fed9.exe
Classification: Malicious
027cc450ef5f8c5f653329641ec1fed9.exe is a ransomware (Windows executable, 353.9 KB). Flagged by 92% of antivirus engines (98 detections).
Detection summary
- 98 antivirus detections (92% detection ratio)
- 0 IDS alerts
- 5 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Mimikatz |
Triage |
2026-03-04 12:32:29 |
2026-10-17 01:17:03 |
malicious-activity
|
S0002 Mimikatz
|
| Generic Malware |
Cyber Threat Alliance |
2026-08-25 10:08:54 |
2026-10-07 18:00:41 |
malicious-activity
|
|
| MimiKatz |
ThreatFox Abuse.ch |
2025-03-17 17:36:58 |
2025-03-19 17:30:50 |
|
S0002 Mimikatz
|
| Generic Malware |
Hybrid-Analysis |
2023-03-08 14:45:06 |
2023-03-08 14:45:06 |
|
|
| Generic.Malware |
Abuse.ch |
2020-03-18 22:41:09 |
2020-03-18 22:41:09 |
|
|
| ransomware,petya,eternalblue,TAG,NotPetya,Petya_NSA_EE_Ransomware,Petna |
Maltiverse |
2018-01-17 12:18:25 |
2018-01-17 12:18:25 |
|
|
Tags
apt
blackenergy
eternalblue
gozi
isfb
papras
petya
quedagh
sandworm
sandwormteam
shamoon
stuxnet
temp.noble
ursnif
voodoobear
wanacrypt0r
wannacry
wcry
zbot
zeus
ransomware
tag
notpetya
petya_nsa_ee_ransomware
petna
win.mimikatz
mimikatz
bootkit
discovery
execution
persistence
spyware
stealer
defense_evasion
Sample information
- Filenames
- 027cc450ef5f8c5f653329641ec1fed9.exe, NotPetya.exe, 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745, iec56w4ibovnb4wc.onion_Library__Ransomeware__NotPetya.bin.malw, petwrap.exe
- File type
- PE32 executable (DLL) (console) Intel 80386, for M ...
- Size
- 362360 bytes
- MD5
71b6a493388e7d0b40c83ce903bc6b04- SHA-1
34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d- SHA-256
027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745- SHA-512
072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f- First indexed
- 2018-01-17 12:18:25
- Last updated
- 2026-10-08 01:07:56
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Trojan.Ransom.Petya |
| APEX | Malicious |
| AVG | MBR:Ransom-C [Trj] |
| AhnLab-V3 | Trojan/Win32.Petya.R203323 |
| Alibaba | Ransom:Win32/Petya.50c |
| Antiy-AVL | Trojan[APT]/Win32.Unit8200 |
| Arcabit | Trojan.Ransom.GoldenEye.B |
| Avast | MBR:Ransom-C [Trj] |
| Avira | TR/Ransom.ME.12 |
| Baidu | Win32.Trojan.Ransom.a |
| BitDefender | Trojan.Ransom.GoldenEye.B |
| Bkav | W32.BeeyWcsjvulA.Trojan |
| CAT-QuickHeal | Ransom.Petya.A5 |
| CTX | dll.trojan.petya |
| ClamAV | Win.Exploit.CVE_2017_0147-6331310-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Encoder.12544 |
| ESET-NOD32 | Win32/Diskcoder.C |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan-Ransom.GoldenEye (A) |
| F-Secure | Trojan:W32/Petya.F |
| FireEye | Generic.mg.71b6a493388e7d0b |
| Fortinet | W32/Petya.EOB!tr |
| GData | Win32.Trojan-Ransom.Petya.V |
| Google | Detected |
| Ikarus | Trojan.Win32.Diskcoder |
| Jiangmin | Trojan.RansomPetya.a |
| K7AntiVirus | Trojan ( 0001140e1 ) |
| K7GW | Trojan ( 0001140e1 ) |
| Kaspersky | Trojan-Ransom.Win32.Petr.xw |
| Kingsoft | Win32.Trojan-Ransom.Petr.xw |
| Lionic | Trojan.Win32.ExPetr.toQK |
| Malwarebytes | Ransom.Petya.EB |
| McAfee | Generic.acn |
| McAfeeD | Real Protect-LS!71B6A493388E |
| MicroWorld-eScan | Trojan.Ransom.GoldenEye.B |
| Microsoft | Ransom:Win32/Petya |
| NANO-Antivirus | Trojan.Win32.Petya.eqlcgp |
| Paloalto | generic.ml |
| Panda | Trj/WLT.C |
| Rising | Ransom.Petya!1.ABCF (CLASSIC) |
| Sangfor | Ransom.Win32.Diskcoder_0.se2 |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | Generic.acn |
| Sophos | Troj/Ransom-EOB |
| Symantec | Ransom.Petya |
| TACHYON | Ransom/W32.Petya.362360 |
| Tencent | Trojan.Win32.Petya.a |
| Trapmine | malicious.high.ml.score |
| TrendMicro | Ransom_PETYA.TH627 |
| TrendMicro-HouseCall | Ransom_PETYA.TH627 |
| VBA32 | Trojan.Ransom.Filecoder |
| VIPRE | Trojan.Ransom.GoldenEye.B |
| Varist | W32/Ransom.ITDM-5086 |
| ViRobot | Trojan.Win32.S.Petya.362360 |
| VirIT | Trojan.Win32.CryptoPetya.F |
| Webroot | W32.Ransomware.Petrwrap |
| Xcitium | TrojWare.Win32.Ransom.Petya.jte@74pyml |
| Zillya | Trojan.Petya.Win32.8 |
| ZoneAlarm | Troj/Ransom-EOB |
| alibabacloud | RansomWare |
| huorong | Worm/NotPetya.a |
| Bkav | W32.RsPetyaND.Worm |
| CMC | RansomWare.Win32.Petya!O |
| Qihoo-360 | Trojan.Generic |
| VIPRE | Win32.Malware!Drop |
| AegisLab | Trojan.Win32.ExPetr.toQK |
| Sangfor | Malware |
| Invincea | heuristic |
| BitDefenderTheta | Gen:NN.ZedlaF.34110.wu5@aO7FY1ci |
| F-Prot | W32/Petya.Ransom.J |
| Zoner | Trojan.Win32.60389 |
| Alibaba | Ransom:Win32/Petya.e399d93f |
| SUPERAntiSpyware | Ransom.Petya/Variant |
| Rising | Ransom.Petya!1.ABCF (CLOUD) |
| Endgame | malicious (high confidence) |
| Comodo | TrojWare.Win32.Ransom.Petya.jte@74pyml |
| McAfee-GW-Edition | Generic.acn |
| Ikarus | Trojan-Ransom.Petrwrap |
| Cyren | W32/Trojan.VUNZ-1981 |
| MAX | malware (ai score=100) |
| Antiy-AVL | Trojan/Win32.SGeneric |
| ZoneAlarm | Trojan-Ransom.Win32.Petr.xw |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ransom.GoldenEye.B |
| Yandex | Trojan.Diskcoder! |
| SentinelOne | DFI - Suspicious PE |
| eGambit | ransom.BadRabbit |
| Avira | TR/BOO.Ransom.C |
| ESET-NOD32 | Win32/Diskcoder.C trojan |
| Malwarebytes | Malware.AI.669764750 |
| MaxSecure | Trojan.Malware.121218.susgen |
| TrellixENS | Generic.acn |
| VBA32 | TrojanRansom.Petr |
| Yandex | Trojan.GenAsa!vcTd17vWXLg |
Process list
| Name | Command line |
|---|
| <Ignored Process> | |
| rundll32.exe | "C:\027cc450ef5f8c5f653329641ec1fed9.exe.dll",#1 |
| cmd.exe | /c schtasks /Create /SC once /TN "" /TR "%WINDIR%\system32\shutdown.exe /r /f" /ST 07:23 |
| schtasks.exe | schtasks /Create /SC once /TN "" /TR "%WINDIR%\system32\shutdown.exe /r /f" /ST 07:23 |
| AF05.tmp | \\.\pipe\{FB6FC522-368B-4E83-89AB-3209E592D593} |