129d4c8ad578c860011f4a4a66a650d502791ec3b7ad73214aae81a6ba3af32a
Classification: Malicious
129d4c8ad578c860011f4a4a66a650d502791ec3b7ad73214aae81a6ba3af32a is a trojan (Windows executable, 272.5 KB). Detected by 57 antivirus engines.
Detection summary
- 57 antivirus detections
- 0 IDS alerts
- 4 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Smokeloader |
Triage |
2026-03-16 15:21:38 |
2026-03-16 15:21:38 |
malicious-activity
|
S0226 Smoke Loader
|
| Lumma Stealer |
ThreatFox Abuse.ch |
2025-04-02 14:22:40 |
2025-04-04 16:12:27 |
|
S1213 Lumma Stealer
|
| Generic Malware |
Hybrid-Analysis |
2024-03-13 23:27:51 |
2024-03-14 01:00:17 |
|
|
Tags
win.lumma
lummac2 stealer
smokeloader
pub1
backdoor
discovery
persistence
trojan
Sample information
- Filenames
- 129d4c8ad578c860011f4a4a66a650d502791ec3b7ad73214aae81a6ba3af32a, 21ce872cb2de555ba869966f19682485.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 279040 bytes
- MD5
21ce872cb2de555ba869966f19682485- SHA-1
85e17145dd3f17128697b4b2a4bfc409dd959e5e- SHA-256
129d4c8ad578c860011f4a4a66a650d502791ec3b7ad73214aae81a6ba3af32a- SHA-512
7efc83752a95598d82cfe4ea699c929f934c641f8900b3da0c8a90436107e0fdbb900b522fa13f4264b573f4d3585aefcaae89b8badbb593de79af06f974caa7- First indexed
- 2024-03-13 23:17:26
- Last updated
- 2026-10-16 03:35:14
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Gen:Variant.BrResMon.280 |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Bot] |
| AhnLab-V3 | Trojan/Win.MalPE.R638032 |
| Alibaba | Trojan:Win32/Kryptik.0bdb758e |
| Antiy-AVL | Trojan/Win32.Kryptik |
| Arcabit | Trojan.BrResMon.280 |
| Avast | Win32:MalwareX-gen [Bot] |
| Avira | TR/W32.MalwareX |
| BitDefender | Gen:Variant.BrResMon.280 |
| Bkav | W32.Malware.79780A58 |
| CTX | exe.trojan.kryptik |
| ClamAV | Win.Packer.pkr_ce1a-9980177-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 99) |
| DrWeb | Trojan.PWS.Stealer.36160 |
| ESET-NOD32 | Win32/Kryptik.HWPD trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Variant.BrResMon.280 (B) |
| F-Secure | Trojan.TR/W32.MalwareX |
| Fortinet | W32/Kryptik.HWMW!tr |
| GData | Gen:Variant.BrResMon.280 |
| Google | Detected |
| Gridinsoft | Ransom.Win32.STOP.tr!n |
| Jiangmin | Trojan.PSW.Stealerc.xz |
| K7AntiVirus | Trojan ( 005b33ee1 ) |
| K7GW | Trojan ( 005690671 ) |
| Kaspersky | HEUR:Backdoor.Win32.Mokes.gen |
| Kingsoft | Win32.Troj.Unknown.a |
| Lionic | Trojan.Win32.Mokes.m!c |
| Malwarebytes | Generic.Malware/Suspicious |
| MaxSecure | Trojan.Malware.73640923.susgen |
| McAfeeD | Trojan:Win/Glupteba.AQ!26 |
| MicroWorld-eScan | Gen:Variant.BrResMon.280 |
| Microsoft | Trojan:Win32/Redline.MI!MTB |
| NANO-Antivirus | Trojan.Win32.Stealer.kkojyk |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Rising | Trojan.SmokeLoader!1.F6B2 (CLASSIC) |
| Sangfor | Trojan.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Dropper.dm |
| Sophos | Troj/Krypt-ADY |
| Symantec | Trojan.Gen.MBT |
| Tencent | Trojan.Win32.Obfuscated.gen |
| TrellixENS | Artemis!21CE872CB2DE |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04CA5 |
| VBA32 | Trojan.Agent |
| VIPRE | Gen:Variant.BrResMon.280 |
| Varist | W32/Kryptik.LUM.gen!Eldorado |
| Webroot | W32.Malware.gen |
| Xcitium | Malware@#2mynw2nlmgdc5 |
| Zillya | Trojan.Kryptik.Win32.4667537 |
| ZoneAlarm | Troj/Krypt-ADY |
| alibabacloud | Backdoor:Win/Azorult.Gen |
| tehtris | Generic.Malware |
Process list
| Name | Command line |
|---|
| 21ce872cb2de555ba869966f19682485.exe | |
| WerFault.exe | -u -p 420 -s 564 |
| WerFault.exe | -u -p 420 -s 564 |
| WerFault.exe | -pss -s 460 -p 420 -ip 420 |