svchost.exe.bin
Classification: Malicious
svchost.exe.bin is a ransomware (Windows executable). Detected by 59 antivirus engines. Linked to Chaos malware. 19 sightings, last seen 2026-10-17.
Detection summary
- 59 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: CHAOS (S0220)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Cyber Threat Alliance | 2026-09-07 10:12:24 | 2026-10-17 10:15:34 | malicious-activity | |
| Chaos | Triage | 2026-09-03 00:43:50 | 2026-09-03 00:43:50 | malicious-activity | S0220 Chaos |
| Generic Malware | Hybrid-Analysis | 2026-07-31 12:45:04 | 2026-07-31 12:45:04 | malicious-activity |
Tags
ransomware chaos persistence privilege_escalation spyware stealerSample information
- Filenames
- svchost.exe.bin, achransomware.exe
- File type
- PE32 executable for MS Windows 4.00 (GUI), Intel i ...
- MD5
b9648ec8cc806e7661aabcfc91dc836c- SHA-1
6d9a25b32282adab3adff2af4499ead01798dbd5- SHA-256
3ff31781fee2a0ae1e7187b4fe60b80f218d06d1434771c190f08442d3e60bc1- First indexed
- 2026-07-31 11:52:03
- Last updated
- 2026-09-04 00:14:22
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.Ransom.Filecoder |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Ransom] |
| AhnLab-V3 | Ransomware/Win.FTD.C4580180 |
| Alibaba | Ransom:MSIL/FileCoder.19360077 |
| Antiy-AVL | Trojan[Ransom]/MSIL.Filecoder |
| Arcabit | Generic.Ransom.HydraCrypt.A32A4BE9 |
| Avast | Win32:MalwareX-gen [Ransom] |
| Avira | TR/W32.MalwareX |
| BitDefender | Generic.Ransom.HydraCrypt.A32A4BE9 |
| Bkav | W32.Malware.19E37A76 |
| CAT-QuickHeal | Trojan.MsilFC.S23210427 |
| CTX | exe.ransomware.msil |
| ClamAV | Win.Ransomware.Hydracrypt-9878672-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.EncoderNET.45 |
| ESET-NOD32 | MSIL/Filecoder.Chaos.A trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Generic.Ransom.HydraCrypt.A32A4BE9 (B) |
| F-Secure | Trojan.TR/W32.MalwareX |
| Fortinet | MSIL/Filecoder.AGP!tr.ransom |
| GData | MSIL.Trojan-Ransom.Remind.B |
| Detected | |
| K7AntiVirus | Ransomware ( 005a8b921 ) |
| K7GW | Ransomware ( 005a8b921 ) |
| Kaspersky | HEUR:Trojan-Ransom.MSIL.Agent.gen |
| Kingsoft | malware.kb.c.1000 |
| Lionic | Trojan.Win32.HydraCrypt.j!c |
| Malwarebytes | Ransom.Chaos |
| MaxSecure | Trojan.Malware.73429809.susgen |
| McAfeeD | Real Protect-LS!B9648EC8CC80 |
| MicroWorld-eScan | Generic.Ransom.HydraCrypt.A32A4BE9 |
| Microsoft | Ransom:MSIL/FileCoder.AD!MTB |
| NANO-Antivirus | Trojan.Win32.Ransom.jrljep |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Rising | Ransom.Destructor!1.B060 (CLASSIC) |
| Sangfor | Virus.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | GenericRXPW-PH!B9648EC8CC80 |
| Sophos | Troj/Ransom-GWT |
| Symantec | Ransom.Sorry |
| Tencent | Trojan-Ransom.Msil.Agent.ga |
| Trapmine | malicious.moderate.ml.score |
| TrellixENS | GenericRXPW-PH!B9648EC8CC80 |
| TrendMicro | Ransom.MSIL.CHAOS.SMRA14 |
| TrendMicro-HouseCall | Ransom.MSIL.CHAOS.SMRA14 |
| VBA32 | Trojan.MSIL.DelShad.Heur |
| VIPRE | Generic.Ransom.HydraCrypt.A32A4BE9 |
| Varist | W32/Azorult.D.gen!Eldorado |
| ViRobot | Trojan.Win32.Z.Hydracrypt.136192 |
| VirIT | Trojan.Win32.MSIL_Heur.A |
| Yandex | Trojan.Filecoder!zkPrX042RU4 |
| Zillya | Trojan.Filecoder.Win32.25552 |
| ZoneAlarm | Troj/Ransom-GWT |
| alibabacloud | Ransomware:Win/Filecoder.APU |
| huorong | Ransom/LockFile.fe |