sub_3090a37e5915.bin

Classification: Malicious

sub_3090a37e5915.bin is a trojan (Windows executable, 4.4 MB). Detected by 48 antivirus engines. Linked to Black Basta malware.

Detection summary

  • 48 antivirus detections
  • 0 IDS alerts
  • 2 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: BLACK BASTA (S1070)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Blackbasta Triage 2026-05-24 01:33:34 2026-05-24 01:33:34 malicious-activity S1070 Black Basta
Generic Malware Cyber Threat Alliance 2026-04-28 17:01:07 2026-04-28 17:01:07
Generic Malware Hybrid-Analysis 2024-05-13 10:00:03 2024-05-13 10:30:05

Tags

evasive infostealer qakbot blackbasta defense_evasion discovery execution impact persistence ransomware

Sample information

Filenames
sub_3090a37e5915.bin, DisplayLocale.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
4647424 bytes
MD5
4e8a7b03ff758f5c75ce992615a14fd0
SHA-1
0110e12ae768872ea5c1b194dba50cbf74ec4d84
SHA-256
3090a37e591554d7406107df87b3dc21bda059df0bc66244e8abef6a5678af35
First indexed
2024-05-13 09:47:08
Last updated
2026-04-28 17:01:07

Antivirus detections

EngineDetection
ALYacGen:Variant.Lazy.454200
APEXMalicious
AVGWin32:RansomX-gen [Ransom]
AlibabaRansom:Win32/Basta.ed527dfb
Antiy-AVLTrojan/Win32.DelShad
ArcabitTrojan.Lazy.D6EE38
AvastWin32:RansomX-gen [Ransom]
AviraTR/AD.PrestigeRansom.wnloh
BitDefenderGen:Variant.Lazy.454200
BitDefenderThetaGen:NN.ZexaF.36804.@x0@aiu8Sidi
BkavW32.Common.32DAD10F
Cylanceunsafe
DeepInstinctMALICIOUS
ESET-NOD32a variant of Win32/Kryptik.HWFL
Elasticmalicious (high confidence)
EmsisoftGen:Variant.Lazy.454200 (B)
F-SecureTrojan.TR/AD.PrestigeRansom.wnloh
FireEyeGen:Variant.Lazy.454200
FortinetW32/PossibleThreat
GDataGen:Variant.Lazy.454200
GoogleDetected
IkarusTrojan.Win32.Crypt
K7AntiVirusTrojan ( 005b18e21 )
K7GWTrojan ( 005b18e21 )
KasperskyHEUR:Trojan.Win32.DelShad.gen
LionicTrojan.Win32.DelShad.4!c
MAXmalware (ai score=80)
MalwarebytesRansom.BlackBasta
MaxSecureTrojan.Malware.74279478.susgen
McAfeeArtemis!4E8A7B03FF75
MicroWorld-eScanGen:Variant.Lazy.454200
MicrosoftRansom:Win32/Basta.IJ!MTB
Paloaltogeneric.ml
PandaTrj/RansomGen.A
RisingTrojan.Agent!1.F623 (CLASSIC)
SangforRansom.Win32.Basta.Vg2a
SkyhighArtemis!Trojan
SophosMal/Generic-S
SymantecTrojan Horse
TencentMalware.Win32.Gencirc.13fffcd7
TrendMicroRansom.Win32.BLACKBASTA.YXEBDT
TrendMicro-HouseCallRansom.Win32.BLACKBASTA.YXEBDT
VIPREGen:Variant.Lazy.454200
VaristW32/ABRansom.XWLF-6187
YandexTrojan.DelShad!E31dj8p926c
ZillyaTrojan.Kryptik.Win32.4562449
ZoneAlarmHEUR:Trojan.Win32.DelShad.gen
alibabacloudTrojan:Win/Basta.IG8PHU

Process list

NameCommand line
DisplayLocale.exe
cmd.exe/c %WINDIR%\SysNative\vssadmin.exe delete shadows /all /quiet