BILD.exe

Classification: Malicious

BILD.exe is a ransomware (Windows executable, 92.5 KB). Flagged by 85% of antivirus engines (74 detections). Linked to Wiper malware.

Detection summary

  • 74 antivirus detections (85% detection ratio)
  • 0 IDS alerts
  • 4 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: WIPER (S0041)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Crytox Triage 2026-10-10 21:52:09 2026-10-10 21:52:09 malicious-activity
Generic Malware Hybrid-Analysis 2023-05-18 06:45:06 2023-05-18 06:45:06
Ransomware VM-Ray 2023-05-13 05:20:36 2023-05-13 05:20:36
Wiper VM-Ray 2023-05-13 05:20:36 2023-05-13 05:20:36 S0041 Wiper

Tags

dharma evasive windows-server-utility crytox credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer

Sample information

Filenames
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3, 1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe, BILD.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
94720 bytes
MD5
786ce74458720ec55b824586d2e5666d
SHA-1
6f62e7fe75a0876939e0dd95d314b83e25e1e395
SHA-256
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3
First indexed
2023-05-13 04:26:25
Last updated
2026-10-16 05:13:37

Antivirus detections

EngineDetection
ALYacTrojan.Ransom.Filecoder
APEXMalicious
AVGWin32:MalwareX-gen [Ransom]
AhnLab-V3Ransomware/Win.Crysis.R213980
AlibabaRansom:Win32/Crusis.2b2
Antiy-AVLTrojan[Ransom]/Win32.Crysis
ArcabitTrojan.Ransom.Crysis.E
AvastWin32:MalwareX-gen [Ransom]
AviraTR/Dropper.Gen
BitDefenderTrojan.Ransom.Crysis.E
BkavW32.AIDetectMalware
CAT-QuickHealRansom.Crysis.A3
CTXexe.ransomware.crysis
ClamAVWin.Trojan.Dharma-6668198-0
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
DrWebTrojan.Encoder.3953
ESET-NOD32a variant of Win32/Filecoder.Crysis.P
ElasticWindows.Ransomware.Dharma
EmsisoftTrojan.Ransom.Crysis.E (B)
F-SecureTrojan.TR/Dropper.Gen
FortinetW32/Crysis.L!tr.ransom
GDataWin32.Trojan-Ransom.VirusEncoder.A
GoogleDetected
GridinsoftRansom.Win32.STOP.dd!se42548
IkarusTrojan-Ransom.Crysis
JiangminTrojan.Crypren.ic
K7AntiVirusTrojan ( 00519f781 )
K7GWTrojan ( 00519f781 )
KasperskyTrojan-Ransom.Win32.Crusis.to
Kingsoftmalware.kb.a.1000
LionicTrojan.Win32.Crusis.tqMs
MalwarebytesGeneric.Ransom.FileCryptor.DDS
MaxSecureTrojan-Ransom.Win32.Crusis.To
McAfeeDReal Protect-LS!786CE7445872
MicroWorld-eScanTrojan.Ransom.Crysis.E
MicrosoftRansom:Win32/Wadhrama!pz
NANO-AntivirusTrojan.Win32.Filecoder.emdnxn
Paloaltogeneric.ml
PandaTrj/GdSda.A
RisingRansom.Crysis!1.A6AA (CLASSIC)
SUPERAntiSpywareRansom.Crysis/Variant
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Suspicious PE
SkyhighBehavesLike.Win32.Generic.nc
SophosTroj/Criakl-G
SymantecRansom.Crysis
TencentTrojan-Ransom.Win32.Crysis.a
Trapminemalicious.high.ml.score
TrellixENSRansom-Dharma!786CE7445872
TrendMicroRansom.Win32.CRYSIS.SM
TrendMicro-HouseCallRansom.Win32.CRYSIS.SM
VBA32TrojanRansom.Crusis
VIPRETrojan.Ransom.Crysis.E
VaristW32/Trojan.ILHO-9216
ViRobotTrojan.Win.S.Ransom.94720
VirITTrojan.Win32.Genus.QKT
WebrootW32.Ransom.Gen
XcitiumTrojWare.Win32.Crysis.D@6sd9xy
YandexTrojan.GenAsa!PU4zXkABPRE
ZillyaTrojan.Filecoder.Win32.29866
ZoneAlarmTroj/Criakl-G
alibabacloudRansomWare
huorongRansom/Crysis.a
Antiy-AVLTrojan[Ransom]/Win32.Crusis
BkavW32.Malware.8909FD40
ESET-NOD32Win32/Filecoder.Crysis.P trojan
K7AntiVirusRansomware ( 005cfd1d1 )
K7GWRansomware ( 005cfd1d1 )
LionicTrojan.Win32.Crusis.n9Mf
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.CrysisRansomware.nc

Process list

NameCommand line
BILD.exe
cmd.exe
BILD.exe
cmd.exe