winvnc.x64.dll

Classification: Malicious

winvnc.x64.dll is a potentially unwanted program (Windows 64-bit executable, 366.0 KB). Flagged by 58% of antivirus engines (73 detections).

Detection summary

  • 73 antivirus detections (58% detection ratio)
  • 0 IDS alerts
  • 7 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: CONTI (S0575)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Cyber Threat Alliance 2026-08-08 10:16:59 2026-08-26 10:25:45 malicious-activity
Conti MalwarePatrol 2026-03-03 18:27:45 2026-03-03 18:27:45 malicious-activity S0575 Conti
Generic Malware Hybrid-Analysis 2023-10-05 17:15:03 2024-03-14 20:45:07
Gen:Variant.Ursu Hybrid-Analysis 2020-12-30 07:15:26 2020-12-30 07:15:26

Tags

ransomware conti

Sample information

Filenames
winvnc.x64.dll
File type
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Size
374784 bytes
MD5
bc9fd6c5621c3fa5a16489db19746112
SHA-1
6cddeac906b3b691c611178b577a9379cfeaa401
SHA-256
13feaa32e4b03ede8799e5bee6f8d54c3af715a6488ad32f6287d8f504c7078b
First indexed
2020-12-30 07:15:26
Last updated
2026-04-18 10:40:51

Antivirus detections

EngineDetection
BkavW32.Common.01EBBC5B
LionicRiskware.Win32.Ursu.1!c
CynetMalicious (score: 99)
ALYacMisc.HackTool.Meterpreter
Cylanceunsafe
ZillyaTool.Meterpreter.Win64.462
SangforPUP.Win32.Inject.V6qg
CrowdStrikewin/grayware_confidence_100% (W)
AlibabaHackTool:Win32/Inject.98b1a157
K7GWRiskware ( 0040eff71 )
K7AntiVirusRiskware ( 0040eff71 )
SymantecTrojan Horse
ElasticWindows.Trojan.CobaltStrike
ESET-NOD32a variant of Win64/Riskware.Meterpreter.H
KasperskyHEUR:HackTool.Win32.Inject.heur
BitDefenderGen:Variant.Tedy.394289
MicroWorld-eScanGen:Variant.Tedy.394289
AvastWin64:Malware-gen
RisingHacktool.Inject!8.36B (CLOUD)
EmsisoftGen:Variant.Tedy.394289 (B)
F-SecurePrivacyRisk.SPR/Injector.agw
DrWebTool.Inject.79
VIPREGen:Variant.Tedy.394289
TrendMicroPUA.Win64.WINVNC.A
McAfee-GW-EditionBehavesLike.Win64.PUPXTH.fh
FireEyeGen:Variant.Tedy.394289
SophosHarmony Loader (PUA)
JiangminHackTool.Inject.ciu
WebrootW32.Malware.Gen
AviraSPR/Injector.agw
MAXmalware (ai score=87)
Antiy-AVLHackTool/Win32.Inject
MicrosoftTrojan:Win32/CobaltStrike!MTB
GridinsoftTrojan.Win64.Agent.dg
XcitiumMalware@#262v94zt9ji48
ArcabitTrojan.Tedy.D60431
ZoneAlarmHEUR:HackTool.Win32.Inject.heur
GDataGen:Variant.Tedy.394289
McAfeeRDN/Generic PUP.z
MalwarebytesMalware.AI.2008835583
PandaTrj/CI.A
TrendMicro-HouseCallPUA.Win64.WINVNC.A
TencentMalware.Win32.Gencirc.11b10f1b
YandexTrojan.Igent.bUAavR.18
SentinelOneStatic AI - Malicious PE
MaxSecureTrojan.Malware.10455307.susgen
FortinetRiskware/Inject
AVGWin64:Malware-gen
DeepInstinctMALICIOUS
AhnLab-V3Malware/Win.Inject.R635405
AlibabaHackTool:Win32/Inject.7bcb0c3d
BkavW64.AIDetectMalware
CAT-QuickHealTrojan.Ghanarava.1749625319746112
CTXdll.trojan.inject
CylanceUnsafe
ElasticWindows.Generic.Threat
GoogleDetected
IkarusPUA.RiskWare.Meterpreter
K7AntiVirusTrojan ( 005457e31 )
K7GWTrojan ( 005457e31 )
KasperskyUDS:HackTool.Win32.Inject.heur
KingsoftWin32.HackTool.Inject.heur
LionicHacktool.Win32.Meterpreter.3!c
MalwarebytesMalware.AI.4268610709
McAfeeDti!13FEAA32E4B0
Paloaltogeneric.ml
RisingTrojan.CobaltStrike!8.EDF2 (TFE:5:iw1lVS3f5fU)
SangforRiskware.Win32.Inject.V67a
SkyhighBehavesLike.Win64.NetLoader.fh
TrellixENSRDN/Generic PUP.z
VaristW64/ABApplication.QKNU-2496
alibabacloudRiskWare:Win/Meterpreter
huorongHackTool/VNCDll.b

Process list

NameCommand line
<Ignored Process>
rundll32.exe"C:\winvnc.x64.dll",#1
<Ignored Process>
rundll32.exe"C:\winvnc.x64.dll",#1
<Ignored Process>
rundll32.exe%WINDIR%\System32\rundll32.exe "C:\winvnc.x64.dll",#1
rundll32.exe"C:\winvnc.x64.dll",#1