TsarBomba.exe

Classification: Malicious

TsarBomba.exe is a trojan (application/x-dosexec, 25.2 MB). Detected by 82 antivirus engines. 39 sightings from 3 threat sources, last seen 2026-09-23.

Detection summary

  • 82 antivirus detections
  • 17 IDS alerts
  • 42 processes observed
  • 49 contacted hosts
  • 26 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Chaos Triage 2026-09-23 15:44:36 2026-09-23 15:44:36 malicious-activity
Ades_stealer Triage 2026-04-21 19:47:51 2026-09-22 01:44:22 malicious-activity
Generic Malware Hybrid-Analysis 2025-08-26 00:00:11 2026-06-18 22:45:06 malicious-activity
Dragonforce Triage 2026-03-23 10:08:15 2026-04-13 20:31:19 malicious-activity
Lockbit Triage 2026-04-12 18:58:50 2026-04-12 18:58:50 malicious-activity
Modiloader Triage 2026-04-11 06:56:19 2026-04-11 06:56:19 malicious-activity
ValleyRAT MalwareBazaar Abuse.ch 2025-06-09 23:30:06 2025-06-09 23:30:06 malicious-activity

Tags

evasive nanocore njrat phishing ransomware trojan ades_stealer chaos cobaltstrike dcrat discordrat dragonforce gcleaner gh0strat jlocker lockbit masslogger modiloader onlylogger raworld redline rokrat sectoprat umbral valleyrat_s2 vidar vipkeylogger xorist xworm 158fdd2a4f5abb978509580715e5353f 987654321 cheat aspackv2 backdoor defense_evasion discovery execution impact infostealer installer keylogger loader persistence rat revoked_codesign rootkit spyware stealer medusaransomware warzonerat adware collection credential_access evasion privilege_escalation hiddentear revengerat spam wshrat bootkit upx

Sample information

Filenames
TsarBomba.exe, TsarBomba.exe.bin, bounty-55627606168977480, silly.exe
File type
application/x-dosexec
Size
26413056 bytes
MD5
91025d6f02e542f2e37ffce7d0ce8b51
SHA-1
e2d80ef6075556cd23ce0445473c061f200b5dd4
SHA-256
3755718db9d33f4aba2563de454d4530a308b41b1096c904102d08e2101f2020
First indexed
2025-06-10 00:18:45
Last updated
2026-09-23 15:55:15

Antivirus detections

EngineDetection
ALYacGen:Variant.Midie.165163
APEXMalicious
AVGWin32:Evo-gen [Trj]
AlibabaTrojanDropper:Win32/Jorik.a95797b7
Antiy-AVLTrojan[Dropper]/Win32.Dapato
ArcabitTrojan.Midie.D2852B
AvastWin32:Evo-gen [Trj]
AviraHEUR/AGEN.1375904
BitDefenderGen:Variant.Midie.165163
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.Ghanarava.1749509247ce8b51
CTXexe.trojan.dapato
CylanceUnsafe
CynetMalicious (score: 99)
DeepInstinctMALICIOUS
DrWebTrojan.Encoder.42191
ESET-NOD32a variant of Win32/TrojanDropper.Agent.SRP
Elasticmalicious (high confidence)
EmsisoftGen:Variant.Midie.165163 (B)
F-SecureHeuristic.HEUR/AGEN.1375904
FortinetW32/Tiny.NFR!tr
GDataGen:Variant.Midie.165163
GoogleDetected
IkarusTrojan.Win32.Tnega
K7AntiVirusTrojan ( 0059450a1 )
K7GWTrojan ( 0059450a1 )
KasperskyTrojan-PSW.Win32.Vidar.dup
LionicTrojan.Win32.Dapato.i!c
MalwarebytesTrojan.Injector
MaxSecureTrojan.Malware.73564251.susgen
McAfeeDti!3755718DB9D3
MicroWorld-eScanGen:Variant.Midie.165163
MicrosoftTrojanDropper:Win32/Dapato!pz
Paloaltogeneric.ml
PandaTrj/CI.A
RisingBackdoor.DcRat!8.129D9 (TFE:1:BNER4NzZWDL)
SkyhighGenericRXTU-AS!91025D6F02E5
SophosMal/Generic-S
SymantecTrojan Horse
TencentMalware.Win32.Gencirc.147e7ed6
Trapminemalicious.high.ml.score
TrendMicro-HouseCallTROJ_GEN.R002C0DEJ25
VBA32BScope.Trojan.Nitol
VIPREGen:Variant.Midie.165163
VaristW32/ABApplication.VTYD-8717
alibabacloudTrojan[dropper]:Win/Dapato.Gen
huorongTrojanSpy/RedLine.q
AhnLab-V3Dropper/Win.Generic.C5769159
AlibabaBackdoor:Win32/Jorik.a95797b7
CAT-QuickHealTrojan.Ghanarava.1759906413ce8b51
CTXexe.trojan.generic
CrowdStrikewin/malicious_confidence_100% (W)
DrWebTrojan.MulDrop32.59534
JiangminTrojan.Generic.hulzb
KasperskyHEUR:Trojan-PSW.MSIL.Reline.gen
KingsoftMSIL.Trojan-PSW.Reline.gen
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SophosTroj/Drop-DND
TrellixENSGenericRXTU-AS!91025D6F02E5
TrendMicroTROJ_GEN.R002C0DEJ25
TrendMicro-HouseCallTrojan.Win32.VSX.PE04C9n
VirITTrojan.Win32.Genus.YBD
XcitiumMalware@#21p5zfs9s6qpa
ZillyaDropper.Agent.Win32.645941
ZoneAlarmTroj/Drop-DND
ALYacGen:Variant.Application.FCA.5508
ArcabitTrojan.Application.FCA.D1584
BitDefenderGen:Variant.Application.FCA.5508
CAT-QuickHealTrojan.Ghanarava.1767990337ce8b51
ESET-NOD32Win32/TrojanDropper.Agent.SRP trojan
EmsisoftGen:Variant.Application.FCA.5508 (B)
GDataGen:Variant.Application.FCA.5508
K7AntiVirusTrojan ( 005ce6931 )
K7GWTrojan ( 005ce6931 )
McAfeeDTrojan:Win/Dropper.AAB
MicroWorld-eScanGen:Variant.Application.FCA.5508
SentinelOneStatic AI - Suspicious PE
TrendMicro-HouseCallTrojan.Win32.VSX.PE04C9z
VIPREGen:Variant.Application.FCA.5508
YandexTrojan.DR.Agent!aeuab6tICzU
huorongTrojanSpy/MSIL.Stealer.aok!crit

Network contacts

142.250.189.99 149.154.167.99 23.61.160.199 154.23.184.57 103.171.35.26 98.177.107.142 154.91.34.165 162.159.136.234 23.54.187.178 74.120.9.233 213.180.204.127 162.159.135.234 142.250.81.227 176.65.144.23 139.99.85.213 193.122.130.0 75.119.193.253 208.95.112.1 45.141.233.69 162.159.128.233 80.91.223.6 192.168.0.0 192.168.0.1 192.168.0.3 192.168.0.4 192.168.0.5 192.168.0.6 192.168.0.7 192.168.0.8 192.168.0.9 192.168.0.10 192.168.0.11 192.168.0.12 192.168.0.13 192.168.0.14 192.168.0.15 192.168.0.16 192.168.0.17 192.168.0.18 192.168.0.19 192.168.0.20 192.168.0.21 192.168.0.22 192.168.0.23 192.168.0.24 192.168.0.25 192.168.0.26 192.168.0.27 192.168.0.28

DNS requests

17.aa.4t.com 252e75b0b54efac68ae3.com blackswmxc.top cladwybn.digital featurlyin.top gateway.discord.gg gstatic.com jackthyfuc.run laminaflbx.shop narrathfpt.top onehunqpom.life overcovtcg.top posseswsnc.top steamcommunity.com t.me www.gstatic.com 21b92e2dfbc16edd9270.com 5kidontknowit.com api.pcloud.com checkip.dyndns.org cloud-api.yandex.net discord.com dontlookhere.com ip-api.com www.dontlookhere.com myhost.misecure.com

Process list

NameCommand line
bounty-55627606168977480.exe
0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
0fd46aca09c54c256d22420d2ac3e947ff204a42a24158dfcb562de18a77f3f1.exe
MSBuild.exe
01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
powershell.exepowershell -Command "& { }"
3e3c7d3f5f93d7bf260aca7612b4dbc5d0e90992841f7e6826d7fb7fa3abe044.exe
4d5ecf3d1955458195771630f03f6ef42f5f62e66ed8e0681f8311d25aecc2bb.exe
5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
6ca05da8350d9f5e5d3a7547c0d4693ebc1190e3b76f58f4196021d0c080c722.exe
7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
9c65d850589e6ab34c6c8e65b8a3b4aa26fa913ca850472023a3b708f95c226b.exe
59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
WerFault.exe-u -p 2232 -s 564
WerFault.exe-u -p 2232 -s 564
65fd5041c1a1c4115b0c59995221023486f02e5e5d8e313c3e48f3a42ef9a623.exe
77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
0379d402a94f960380d7d91e3bfa106eeac01cd39ae7b0ba5010ba737088a215.exe
539b377d4a33d1e884f18ecf0e0b0330e5dc26023b7ae051843cac8014142d98.exe
577b3a152ddc9d6558ad1b38ef6da89257229adf06d298ea025048a6d5d2fcea.exe
755b9e89416a664f52a0dfee6de54687f15ae900a7317763b0a4144996724f6a.exe
771a06e3a1bdb42a7249d1c888e740c2bc46ba30b54490188c17f6c84ca96e26.exe
876ba1145745c2e088c0df36f8241a20916a092211d05646eae5c7004dd4d429.exe
954d8fcd6b74d76999f9ec033ca855ffdab6595be23039f03bc4c6017fa3932c.exe
4797cb80b22ba0da0ede6593bfc16399a5ffc289400155115c8de7786ea0db49.exe