Classification: Malicious
sub_309c15c52e4d.bin is a trojan (Windows 64-bit executable, 230.5 KB). Flagged by 26% of antivirus engines (18 detections). Linked to Ta505 activity.
Detection summary
- 18 antivirus detections (26% detection ratio)
- 0 IDS alerts
- 3 processes observed
- 1 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Ta505 |
Triage |
2026-05-24 01:28:21 |
2026-05-24 01:28:21 |
malicious-activity
|
G0092 TA505
|
| Gen:Variant.Ursu |
Hybrid-Analysis |
2020-01-23 12:00:36 |
2020-01-23 12:00:36 |
|
|
Sample information
- Filenames
- sub_309c15c52e4d.bin, contract_x64.dll
- File type
- PE32+ executable (DLL) (GUI) x86-64 (stripped to e ...
- Size
- 236032 bytes
- MD5
267f1f3a4d0d5f9da2ec4f51c16bcfa7- SHA-1
aa87372177cdaeba5ca23b2ec1616d8bcd37c966- SHA-256
309c15c52e4d61e15901051428ea00e1b9c916ac6bc69449c03239e110864343- First indexed
- 2020-01-23 12:00:36
- Last updated
- 2026-08-29 23:28:07
Antivirus detections
| Engine | Detection |
|---|
| MicroWorld-eScan | Gen:Variant.Ursu.732393 |
| Cylance | Unsafe |
| Sangfor | Malware |
| CrowdStrike | win/malicious_confidence_80% (D) |
| Invincea | heuristic |
| APEX | Malicious |
| BitDefender | Gen:Variant.Ursu.732393 |
| Endgame | malicious (high confidence) |
| Trapmine | suspicious.low.ml.score |
| FireEye | Generic.mg.267f1f3a4d0d5f9d |
| Emsisoft | Gen:Variant.Ursu.732393 (B) |
| MAX | malware (ai score=81) |
| Microsoft | Trojan:Win32/Detplock |
| Arcabit | Trojan.Ursu.DB2CE9 |
| GData | Gen:Variant.Ursu.732393 |
| ALYac | Gen:Variant.Ursu.732393 |
| Ad-Aware | Gen:Variant.Ursu.732393 |
| Rising | Trojan.Inject!8.103 (TFE:dGZlOgQQCs9CuS7PlA) |
Process list
| Name | Command line |
|---|
| <Ignored Process> | |
| rundll32.exe | %WINDIR%\System32\rundll32.exe "C:\contract_x64.dll",#1 |
| rundll32.exe | "C:\contract_x64.dll",#1 |