860e50.exe

Classification: Malicious

860e50.exe is a malicious file sample. Linked to Ryuk malware. Reported by 2 threat sources, last seen 2022-01-28. Detected by 93 antivirus engines.

Detection summary

  • 93 antivirus detections (85% detection ratio)
  • 0 IDS alerts
  • 124 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: RYUK (S0446)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Ryuk MalwareBazaar Abuse.ch 2022-01-28 10:28:24 2022-01-28 10:28:24 malicious-activity S0446 Ryuk
Generic.Ransom.Ryuk Hybrid-Analysis 2020-11-05 01:30:07 2020-11-05 01:30:07

Tags

ransomware

Sample information

Filenames
860e50.exe, EIMnwkN.bin
File type
application/x-dosexec
Size
201136 bytes
MD5
484a2bcb1335ac97ee91194f4c0964bc
SHA-1
ad11ed52ab33ad05eb9b1e9ade134ca1348acc81
SHA-256
40b865d1c3ab1b8544bcf57c88edd30679870d40b27d62feb237a19f0c5f9cd1
First indexed
2020-11-05 01:30:07
Last updated
2025-11-02 01:47:57

Antivirus detections

EngineDetection
BkavW32.AIDetect.malware1
LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGeneric.Ransom.Ryuk.64849FC5
FireEyeGeneric.mg.484a2bcb1335ac97
McAfeeRansom-Ryuk!484A2BCB1335
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforRansom.Win32.Ryuk_15.se2
K7AntiVirusTrojan ( 005505341 )
AlibabaRansom:Win32/Ryuk.ali1020007
K7GWTrojan ( 005505341 )
CrowdStrikewin/malicious_confidence_100% (W)
CyrenW32/FileCoder.C.gen!Eldorado
SymantecRansom.Hermes!gen2
ESET-NOD32a variant of Win32/Filecoder.Ryuk.M
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Ransomware.Ryuk-9859740-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGeneric.Ransom.Ryuk.64849FC5
NANO-AntivirusTrojan.Win32.Filecoder.hkjcbh
AvastWin32:RansomX-gen [Ransom]
TencentWin32.Trojan.Raas.Auto
Ad-AwareGeneric.Ransom.Ryuk.64849FC5
SophosMal/Generic-R + Troj/Ransom-FAF
ComodoMalware@#26sjkojudy1ce
DrWebTrojan.Encoder.32972
ZillyaTrojan.Generic.Win32.1247924
TrendMicroRansom.Win32.RYUK.SMG
McAfee-GW-EditionBehavesLike.Win32.RansomRyuk.cm
EmsisoftGeneric.Ransom.Ryuk.64849FC5 (B)
IkarusTrojan-Ransom.Ryuk
GDataWin32.Trojan-Ransom.Filecoder.CF@gen
AviraTR/Crypt.ZPACK.Gen2
Antiy-AVLTrojan/Generic.ASMalwS.3069B98
MicrosoftRansom:Win32/Ryuk.DB!MTB
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.RL_Cryptor.R293548
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.34266.mqX@aKu7cZ
ALYacTrojan.Ransom.Ryuk
MAXmalware (ai score=100)
VBA32BScope.TrojanRansom.Cryptor
MalwarebytesRansom.Ryuk
TrendMicro-HouseCallRansom.Win32.RYUK.SMG
RisingRansom.Ryuk!1.B585 (CLASSIC)
YandexTrojan.GenAsa!YDOl+6P/vDM
SentinelOneStatic AI - Malicious PE
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Filecoder.AC!tr
AVGWin32:RansomX-gen [Ransom]
Cybereasonmalicious.b1335a
PandaTrj/GdSda.A
BitDefenderThetaGen:NN.ZexaF.34182.mqX@aKu7cZ
RisingRansom.Ryuk!1.B585 (CLOUD)
McAfee-GW-EditionBehavesLike.Win32.Generic.cm
SentinelOneStatic AI - Suspicious PE
MAXmalware (ai score=94)
KingsoftWin32.Heur.KVMH008.a.(kcloud)
AVGWin32:MalwareX-gen [Ransom]
AlibabaRansom:Win32/Ransomware.901
Antiy-AVLTrojan[Ransom]/Win64.Ryuk
ArcabitGeneric.Ransom.Ryuk.64849FC5
AvastWin32:MalwareX-gen [Ransom]
BkavW32.AIDetectMalware
CAT-QuickHealRansom.Ryuk.S30538102
CTXexe.ransomware.ryuk
DeepInstinctMALICIOUS
ElasticWindows.Ransomware.Ryuk
F-SecureTrojan.TR/Crypt.ZPACK.Gen2
FortinetW32/Ryuk.D!tr.ransom
GoogleDetected
JiangminTrojan.Generic.hfacy
Kingsoftmalware.kb.a.1000
LionicTrojan.Win32.Ryuk.4!c
MalwarebytesGeneric.Malware.AI.DDS
MaxSecureTrojan.Malware.7164915.susgen
McAfeeDReal Protect-LS!484A2BCB1335
SkyhighBehavesLike.Win32.Generic.cm
SophosTroj/Ryuk-F
SymantecRansom.Ryuk
TACHYONRansom/W32.Ryuk.201136
TencentMalware.Win32.Gencirc.10be2807
Trapminemalicious.high.ml.score
TrellixENSRansom-Ryuk!484A2BCB1335
VIPREGeneric.Ransom.Ryuk.64849FC5
VaristW32/FileCoder.C.gen!Eldorado
WebrootW32.Malware.Gen
XcitiumMalware@#26sjkojudy1ce
ZoneAlarmTroj/Ransom-FAF
alibabacloudRansomWare:Win/Ryuk
huorongRansom/Ryuk.a

Process list

NameCommand line
EIMnwkN.bin.exe
iegLdQD.exe8 LAN
icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q
icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q
icacls.exeicacls "Z:\*" /grant Everyone:F /T /C /Q
cmd.execmd /c "WMIC.exe shadowcopy delet"
WMIC.exeshadowcopy delet
vssadmin.exeDelete Shadows /all /quiet
bcdedit.exebcdedit /set {default} recoveryenabled No & bcdedit /set {default}
net.exestop "samss" /y
net1.exe%WINDIR%\system32\net1 stop "samss" /y
cmd.exe/C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\iegLdQD.exe" /f
reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\iegLdQD.exe" /f
net.exestop "samss" /y
net1.exe%WINDIR%\system32\net1 stop "samss" /y
net.exestop "samss" /y
net1.exe%WINDIR%\system32\net1 stop "samss" /y
net.exestop "samss" /y
net1.exe%WINDIR%\system32\net1 stop "samss" /y
net.exestop "samss" /y
net1.exe%WINDIR%\system32\net1 stop "samss" /y
net.exestop "samss" /y
net1.exe%WINDIR%\system32\net1 stop "samss" /y
net.exestop "samss" /y
net1.exe%WINDIR%\system32\net1 stop "samss" /y
net.exestop "samss" /y
net1.exe%WINDIR%\system32\net1 stop "samss" /y
taskhost.exe
icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q
icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q