lsass.exe

Classification: Malicious

lsass.exe is a trojan (Windows executable, 265.9 KB). Flagged by 70% of antivirus engines (93 detections). Linked to Xloader malware.

Detection summary

  • 93 antivirus detections (70% detection ratio)
  • 0 IDS alerts
  • 2 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: XLOADER (S1207)

Intrusion sets: APT37 (G0067)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Apt37 Maltiverse 2023-07-04 04:28:54 2023-07-05 20:50:46 malicious-activity G0067 APT37
Generic Malware Hybrid-Analysis 2023-06-30 01:15:03 2023-06-30 01:15:03
Formbook MalwareBazaar Abuse.ch 2023-06-20 04:47:00 2023-06-20 04:47:00 malicious-activity S1207 XLoader

Tags

apt

Sample information

Filenames
fa24b7c4c3dc0c6d0b942eb96e4f18a0, lsass.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows, ...
Size
272284 bytes
MD5
fa24b7c4c3dc0c6d0b942eb96e4f18a0
SHA-1
37be005b43001e4a3cd0bf922c3c5092b711ecaf
SHA-256
1fcaaed1008bcb79bbfac57a3927a03a8364ab00fce3080b2ea581116a6e8ba6
First indexed
2023-06-20 06:18:14
Last updated
2026-04-29 05:49:06

Antivirus detections

EngineDetection
BkavW32.AIDetectMalware
LionicTrojan.Win32.Agent.tshg
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Nemesis.22774
FireEyeGeneric.mg.fa24b7c4c3dc0c6d
CAT-QuickHealTrojan.Avemariarat
McAfeeArtemis!FA24B7C4C3DC
MalwarebytesTrojan.Loader
SangforSuspicious.Win32.Save.ins
K7AntiVirusTrojan ( 005a6c251 )
AlibabaTrojan:Application/Generic.acb3471c
K7GWTrojan ( 005a6c251 )
Cybereasonmalicious.4c3dc0
VirITTrojan.Win32.Genus.RHT
CyrenW32/ABRisk.QHLS-5482
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Injector.ETAW
APEXMalicious
KasperskyHEUR:Trojan-Spy.Win32.Noon.gen
BitDefenderGen:Variant.Nemesis.22774
AvastWin32:InjectorX-gen [Trj]
TencentWin32.Trojan-Spy.Noon.Anhl
SophosMal/Generic-S
F-SecureTrojan.TR/Redcap.jxawb
VIPREGen:Variant.Nemesis.22774
TrendMicroTROJ_GEN.R002C0DFJ23
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
Trapminemalicious.moderate.ml.score
EmsisoftGen:Variant.Nemesis.22774 (B)
SentinelOneStatic AI - Suspicious PE
GDataZum.Androm.1
GoogleDetected
AviraTR/AD.GenShell.hswgb
MAXmalware (ai score=85)
Antiy-AVLTrojan/Win32.Injector
ArcabitTrojan.Nemesis.D58F6 [many]
ZoneAlarmHEUR:Trojan-Spy.Win32.Noon.gen
MicrosoftTrojan:Win32/Leonem
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Generic.R585815
Cylanceunsafe
PandaTrj/GdSda.A
TrendMicro-HouseCallTROJ_GEN.R002C0DFJ23
RisingTrojan.Injector!8.C4 (TFE:6:I3RwG4Ux51M)
YandexTrojan.Injector!CMkfvt0VUfA
IkarusTrojan.Win32.Injector
FortinetNSIS/Agent.DCAC!tr
AVGWin32:InjectorX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)
ALYacTrojan.Generic.37787538
AVGWin32:MalwareX-gen [Inj]
AlibabaTrojan:Win32/Injector.490d3bd9
Antiy-AVLTrojan/Win32.Avemariarat
ArcabitTrojan.Generic.D2409792
AvastWin32:MalwareX-gen [Inj]
AviraHEUR/AGEN.1369216
BitDefenderTrojan.Generic.37787538
CTXexe.trojan.generic
CylanceUnsafe
DrWebTrojan.Loader.1550
ESET-NOD32Win32/Injector.ETAW trojan
EmsisoftTrojan.Generic.37787538 (B)
F-SecureHeuristic.HEUR/AGEN.1364646
GDataTrojan.Generic.37787538
IkarusTrojan-Spy.FormBook
K7AntiVirusTrojan ( 005a8a8d1 )
KasperskyHEUR:Trojan.Win32.Agent.gen
KingsoftWin32.Trojan.Agent.gen
LionicTrojan.Win32.Noon.4!c
MalwarebytesGeneric.Malware/Suspicious
MaxSecureTrojan.Malware.381000299.susgen
McAfeeDti!1FCAAED1008B
MicroWorld-eScanTrojan.Generic.37787538
NANO-AntivirusTrojan.Win32.Redcap.jwtcnu
PandaTrj/CI.A
RisingTrojan.Injector!8.C4 (CLOUD)
SangforTrojan.Win32.Save.a
SkyhighBehavesLike.Win32.Dropper.dc
SophosTroj/Inject-JBY
SymantecTrojan Horse
TencentWin32.Trojan.Agent.Anhl
TrellixENSArtemis!FA24B7C4C3DC
TrendMicro-HouseCallTrojan.Win32.VSX.PE04C9z
VBA32TrojanSpy.Noon
VIPRETrojan.Generic.37787538
VaristW32/Ninjector.JO.gen!Eldorado
ViRobotTrojan.Win.Z.Agent.272284
XcitiumMalware@#25dajgt2xwyj
ZillyaTrojan.Noon.Win32.28876
ZoneAlarmTroj/Inject-JBY
ZonerTrojan.Win32.157752
alibabacloudTrojan:Win/Injector.ESZE

Process list

NameCommand line
lsass.exe
lsass.exe