Classification: Malicious
fpfid.football_nano.exe is a ransomware (Windows executable). Detected by 51 antivirus engines. Reported by Hybrid-Analysis and Triage, last seen 2026-10-18.
Detection summary
- 51 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Hybrid-Analysis |
2026-10-18 05:45:03 |
2026-10-18 05:45:03 |
malicious-activity
|
|
| Nanocore |
Triage |
2026-10-18 05:36:07 |
2026-10-18 05:36:07 |
malicious-activity
|
|
Tags
evasive
hiddentear
infostealer
umbrella
winnti
nanocore
defense_evasion
discovery
evasion
execution
impact
keylogger
persistence
privilege_escalation
ransomware
spyware
stealer
trojan
Sample information
- Filenames
- fpfid.football_nano.exe, sample-1c0465091c31.exe
- File type
- PE32 executable for MS Windows 4.00 (GUI), Intel i ...
- MD5
b791cf40b9841cd551b56dbbe042571d
- SHA-1
d14c230f6ccb02544830e124d4cc518de9570785
- SHA-256
1c0465091c313025ba1b2c2f7af346513e4462385bb67cdf710bccf4de4f70c8
- First indexed
- 2026-10-18 05:36:07
- Last updated
- 2026-10-18 05:55:49
Antivirus detections
| Engine | Detection |
| ALYac | Generic.Ransom.Hiddentear.A.A26F3998 |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Ransom] |
| AhnLab-V3 | Trojan/Win.MSILZilla.C5577622 |
| Antiy-AVL | RiskWare/Win32.Agent |
| Arcabit | Generic.Ransom.Hiddentear.A.A26F3998 |
| Avast | Win32:MalwareX-gen [Ransom] |
| Avira | TR/Dropper.Gen |
| BitDefender | Generic.Ransom.Hiddentear.A.A26F3998 |
| Bkav | W32.Malware.3E372439 |
| CTX | exe.ransomware.hiddentear |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.InjectNET.14 |
| ESET-NOD32 | MSIL/Agent.YJE trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Generic.Ransom.Hiddentear.A.A26F3998 (B) |
| F-Secure | Trojan.TR/Dropper.Gen |
| Fortinet | MSIL/Agent.EGC!tr |
| GData | Generic.Ransom.Hiddentear.A.A26F3998 |
| Google | Detected |
| Ikarus | Trojan.MSIL.NanoCore |
| K7AntiVirus | Spyware ( 700000201 ) |
| K7GW | Spyware ( 700000201 ) |
| Kaspersky | HEUR:Worm.MSIL.Agent.gen |
| Kingsoft | malware.kb.c.999 |
| Malwarebytes | Ransom.FileCryptor |
| MaxSecure | Trojan.Malware.300983.susgen |
| McAfeeD | Real Protect-LS!B791CF40B984 |
| MicroWorld-eScan | Generic.Ransom.Hiddentear.A.A26F3998 |
| Microsoft | Ransom:MSIL/CryptoLocker.DA!MTB |
| NANO-Antivirus | Trojan.Win32.Ransom.lkaiqk |
| Panda | Trj/GdSda.A |
| Rising | Exploit.UACBypass!1.DEAD (CLASSIC) |
| Sangfor | Suspicious.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | Ransomware-IIU!B791CF40B984 |
| Sophos | Mal/MsilInj-F |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Trojan.Win32.DelShad.16003763 |
| Trapmine | malicious.moderate.ml.score |
| TrendMicro | Ransom.MSIL.FILELOCK.SM |
| TrendMicro-HouseCall | Ransom.MSIL.FILELOCK.SM |
| VBA32 | Trojan.MSIL.DelShad.Heur |
| VIPRE | Generic.Ransom.Hiddentear.A.A26F3998 |
| Varist | W32/MSIL_Troj.C.gen!Eldorado |
| VirIT | Trojan.Win32.MSIL_Heur.B |
| Zillya | Trojan.AgentGen.Win32.119 |
| ZoneAlarm | Mal/MsilInj-F |
| huorong | Ransom/LockFile.au |