taskhostws.exe

Classification: Malicious

taskhostws.exe is a trojan (Windows executable, 938.4 KB). Detected by 17 antivirus engines. Linked to Turla activity. 7 sightings, last seen 2026-09-20.

Detection summary

  • 17 antivirus detections
  • 5 IDS alerts
  • 4 processes observed
  • 5 contacted hosts
  • 2 DNS requests

MITRE ATT&CK associations

Intrusion sets: TURLA (G0010)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-10-17 12:45:05 2026-09-20 08:45:07 malicious-activity
Snake ThreatFox Abuse.ch 2025-02-20 09:37:15 2025-02-22 09:44:49 G0010 Turla
Generic.Malware MalwareBazaar Abuse.ch 2024-10-17 12:26:15 2024-10-17 12:26:15 malicious-activity

Tags

evasive win.snake ekans snakehose keylogger

Sample information

Filenames
03461c2a07431aed5ff68bbcf42d7ef82f32190b44ba140befd3f474614b5f3d, taskhostws.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
960873 bytes
MD5
b47e4f366b08fe509c2a8f9ee7251f51
SHA-1
3338dd3e335d1e8e6ee0d4c0c607248d333c25c1
SHA-256
03461c2a07431aed5ff68bbcf42d7ef82f32190b44ba140befd3f474614b5f3d
First indexed
2024-10-17 12:29:56
Last updated
2026-09-20 08:45:07

Antivirus detections

EngineDetection
APEXMalicious
BkavW32.AIDetectMalware
CAT-QuickHealTrojanPWS.AutoIt.Zbot.S
CrowdStrikewin/malicious_confidence_90% (D)
CylanceUnsafe
CynetMalicious (score: 100)
Elasticmalicious (high confidence)
FortinetAutoIt/Injector.GND!tr
GoogleDetected
K7AntiVirusTrojan ( 700000111 )
K7GWTrojan ( 700000111 )
MaxSecureTrojan.Malware.300983.susgen
MicrosoftTrojan:Win32/Phonzy.A!ml
SkyhighBehavesLike.Win32.Ransomware.dc
SophosTroj/AutoIt-DHB
VBA32Trojan.Autoit.F
VaristW32/Autoit.XXWI-5918

Network contacts

132.226.247.73 104.21.67.152 158.101.44.242 172.67.177.134 193.122.130.0

DNS requests

checkip.dyndns.org reallyfreegeoip.org

Process list

NameCommand line
taskhostws.exe
RegSvcs.exe"C:\taskhostws.exe"
taskhostws.exe
RegSvcs.exe"C:\taskhostws.exe"