file

Classification: Malicious

file is a malicious file sample. Reported by 2 threat sources, last seen 2024-04-06. Detected by 81 antivirus engines.

Detection summary

  • 81 antivirus detections
  • 1 IDS alerts
  • 4 processes observed
  • 2 contacted hosts
  • 1 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Meduza Stealer ThreatFox Abuse.ch 2024-04-04 14:48:32 2024-04-06 14:20:25
Generic Malware Hybrid-Analysis 2024-04-04 09:45:06 2024-04-04 10:30:11

Tags

win.meduza

Sample information

Filenames
file
File type
PE32+ executable (GUI) x86-64, for MS Windows
Size
4305522 bytes
MD5
c3e44b324eb2145c756c3e5de7b4defb
SHA-1
150238e4629d6941f95d1ab7a6e84897e5bbabd9
SHA-256
0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d
First indexed
2024-04-04 09:23:42
Last updated
2026-09-03 00:26:12

Antivirus detections

EngineDetection
BkavW64.AIDetectMalware
CrowdStrikewin/malicious_confidence_70% (D)
ESET-NOD32a variant of Win64/GenKryptik.GVVM
Elasticmalicious (high confidence)
FortinetW64/GenKryptik.MANG!tr
GoogleDetected
GridinsoftTrojan.Heur!.02046023
IkarusTrojan.Win64.Crypt
MicrosoftProgram:Win32/Wacapew.C!ml
ALYacGeneric.Malv.A.6B143819
AVGWin64:Evo-gen [Trj]
AhnLab-V3Trojan/Win.PWSX-gen.R643454
AlibabaTrojan:Win64/GenKryptik.b0b12d4e
Antiy-AVLTrojan/Win64.GenKryptik
ArcabitGeneric.Malv.A.6B143819
AvastWin64:Evo-gen [Trj]
AviraTR/AD.Nekark.tqpdy
BitDefenderGeneric.Malv.A.6B143819
CAT-QuickHealTrojan.Ghanarava.1714463709b4defb
CTXexe.trojan.generic
ClamAVWin.Malware.Gkox-10033049-0
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
CynetMalicious (score: 99)
DeepInstinctMALICIOUS
DrWebTrojan.PWS.Meduza.11
EmsisoftGeneric.Malv.A.6B143819 (B)
F-SecureTrojan.TR/AD.Nekark.tqpdy
GDataGeneric.Malv.A.6B143819
IkarusTrojan-Spy.Meduza
JiangminBackdoor.Androm.bfgg
K7AntiVirusTrojan ( 005b3cd71 )
K7GWTrojan ( 005b3cd71 )
KasperskyTrojan-PSW.Win64.Stealer.aiun
KingsoftWin32.Troj.Unknown.a
LionicTrojan.Win32.Stealer.12!c
MalwarebytesTrojan.MalPack.Generic
MaxSecureTrojan.Malware.238220722.susgen
McAfeeMeduza!C3E44B324EB2
McAfeeDti!0F8B8E294577
MicroWorld-eScanGeneric.Malv.A.6B143819
MicrosoftTrojan:Win64/AgentTesla!MTB
NANO-AntivirusTrojan.Win64.Meduza.klgqki
Paloaltogeneric.ml
PandaTrj/Chgt.AD
RisingTrojan.Kryptik!8.8 (TFE:5:XqyEUCoWdGL)
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Suspicious PE
SkyhighMeduza!C3E44B324EB2
SophosMal/Generic-S
SymantecML.Attribute.HighConfidence
TACHYONTrojan-PWS/W64.InfoStealer.4305522
TencentMalware.Win32.Gencirc.10bfcef2
TrendMicro-HouseCallTrojan.Win32.VSX.PE04C9Z
VBA32TrojanSpy.Medusa
VIPREGeneric.Malv.A.6B143819
VaristW64/Kryptik.LLH.gen!Eldorado
VirITTrojan.Win64.Genus.GNK
WebrootW32.Trojan.Gen
XcitiumMalware@#1gw4y5lvh1ny7
YandexTrojan.DL.PBLoader!vA2bI8250wI
ZillyaTrojan.Diztakun.Win32.9402
alibabacloudTrojan[stealer]:Win/Stealer.aiun
huorongTrojan/Injector.bkt
AVGWin64:MalwareX-gen [Trj]
Antiy-AVLTrojan/Win64.Nekark
AvastWin64:MalwareX-gen [Trj]
AviraTR/W64.MalwareX
BkavW32.Malware.3E1275AA
ESET-NOD32Win64/GenKryptik.GVVM trojan
F-SecureTrojan.TR/W64.MalwareX
GridinsoftTrojan.Win64.Kryptik.oa!s1
K7AntiVirusTrojan ( 005f08f61 )
K7GWTrojan ( 005f08f61 )
LionicTrojan.Win32.Malv.i!c
McAfeeDTrojan:Win/Stealer.D
SentinelOneStatic AI - Malicious PE
SymantecTrojan Horse
TrellixENSMeduza!C3E44B324EB2
TrendMicroTROJ_GEN.R06EC0DFQ26
TrendMicro-HouseCallTROJ_GEN.R06EC0DFQ26

Network contacts

5.182.86.229 104.26.13.205

DNS requests

api.ipify.org

Process list

NameCommand line
file.exe
ngen.exe
cmd.exe/C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
PING.EXEping 1.1.1.1 -n 1 -w 3000