Classification: Malicious
System.exe is a trojan (Windows executable, 142.0 KB). Flagged by 70% of antivirus engines (58 detections). Linked to Apt37 activity.
Detection summary
- 58 antivirus detections (70% detection ratio)
- 1 IDS alerts
- 3 processes observed
- 1 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Apt37 |
Maltiverse |
2023-07-04 04:28:51 |
2023-07-05 20:50:57 |
malicious-activity
|
G0067 APT37
|
| Trojan.Generic |
Hybrid-Analysis |
2021-03-16 03:30:22 |
2021-03-16 03:30:22 |
|
|
Sample information
- Filenames
- System.exe
- File type
- PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
- Size
- 145408 bytes
- MD5
161147d142f2c7c633559aa0d4d13ae5- SHA-1
6c6c932150e4d5975a289a1b14087f46556dcad6- SHA-256
17575812be2861c87f421f9bf5253293c7c4660006ef41b748dddb2d5e9972fe- First indexed
- 2021-03-16 03:30:22
- Last updated
- 2025-12-16 01:01:17
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Gen:Variant.Barys.371258 |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| AhnLab-V3 | Trojan/Win32.Bladabindi.C3279316 |
| Alibaba | Trojan:MSIL/Kryptik.aaf2080e |
| Antiy-AVL | RiskWare[Downloader]/Win32.Agent |
| Arcabit | Trojan.Barys.D5AA3A |
| Avast | Win32:Malware-gen |
| Avira | TR/Dropper.Gen7 |
| BitDefender | Gen:Variant.Barys.371258 |
| Bkav | W32.AIDetectMalware.CS |
| CAT-QuickHeal | Trojan.Ghanarava.1737725243d13ae5 |
| CTX | exe.trojan.msil |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.DownLoader28.37095 |
| ESET-NOD32 | a variant of MSIL/Kryptik.UDC |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Variant.Barys.371258 (B) |
| F-Secure | Trojan.TR/Dropper.Gen7 |
| FireEye | Generic.mg.161147d142f2c7c6 |
| Fortinet | W32/Generic!tr |
| GData | Gen:Variant.Barys.371258 |
| Google | Detected |
| Gridinsoft | Trojan.Heur!.03013281 |
| Ikarus | Trojan.Agent |
| K7AntiVirus | Trojan ( 005506421 ) |
| K7GW | Trojan ( 005506421 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Kingsoft | malware.kb.c.1000 |
| Lionic | Trojan.Win32.Bladabindi.4!c |
| Malwarebytes | Generic.Crypt.Trojan.DDS |
| MaxSecure | Trojan.Malware.7164915.susgen |
| McAfee | Artemis!161147D142F2 |
| MicroWorld-eScan | Gen:Variant.Barys.371258 |
| Microsoft | Backdoor:MSIL/Bladabindi |
| NANO-Antivirus | Trojan.Win32.Mlw.fqwsxq |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:QnYKlYh8t3qFzbigAqOPjg) |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.RAHack.cc |
| Sophos | Mal/Generic-S |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Win32.Trojan.Generic.Njgl |
| Trapmine | malicious.high.ml.score |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04C9V |
| VBA32 | CIL.StupidPInvoker-1.Heur |
| VIPRE | Gen:Variant.Barys.371258 |
| Varist | W32/ABTrojan.GOHU-9210 |
| ViRobot | Trojan.Win32.Z.Bladabindi.145408.BO |
| VirIT | Trojan.Win32.Dnldr28.CCWT |
| Xcitium | Malware@#2eqps2aerlbhv |
| Yandex | Trojan.Agent!sC71nZ+JbWs |
| Zillya | Trojan.Kryptik.Win32.3580552 |
| Zoner | Probably Heur.ExeHeaderL |
| alibabacloud | Backdoor:MSIL/Bladabindi.Gen |
Process list
| Name | Command line |
|---|
| System.exe | |
| System.exe | |
| netsh.exe | netsh firewall add allowedprogram "%TEMP%\System.exe" "System.exe" ENABLE |