44a7bea8a08f4c2feb74c6a00ff1114ba251f3dc6922ea5ffab9e749c98cbdce.exe

Classification: Malicious

44a7bea8a08f4c2feb74c6a00ff1114ba251f3dc6922ea5ffab9e749c98cbdce.exe is a malicious file sample. Linked to Poisonivy malware.

Detection summary

  • 62 antivirus detections (75% detection ratio)
  • 0 IDS alerts
  • 3 processes observed
  • 0 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Malware families: POISONIVY (S0012)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Poisonivy Triage 2026-02-21 02:10:12 2026-02-21 02:10:12 malicious-activity S0012 PoisonIvy
Generic Malware Hybrid-Analysis 2023-12-19 13:33:14 2025-02-08 15:00:24
backdoor,banker,dridex,plugx Maltiverse 2018-02-04 02:41:04 2018-02-04 02:41:04

Tags

backdoor banker dridex plugx windows-server-utility poisonivy discovery rat

Sample information

Filenames
44a7bea8a08f4c2feb74c6a00ff1114ba251f3dc6922ea5ffab9e749c98cbdce.exe, 4f505ca0ea4540e6662def1c1ddadd03
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
61440 bytes
MD5
4f505ca0ea4540e6662def1c1ddadd03
SHA-1
b23d698df6594f690f3462e238e1e9f2ec029bbf
SHA-256
44a7bea8a08f4c2feb74c6a00ff1114ba251f3dc6922ea5ffab9e749c98cbdce
SHA-512
faa09372c6e2d7dd9fd323dad5a8f528e51d51d16c0f117e829ad01bdba51a31eaa06a5a2bb8f7dd896b33bb53a27ff4cac23728225ca24d377715f4db851353
First indexed
2018-02-04 02:41:04
Last updated
2026-04-15 15:44:57

Antivirus detections

EngineDetection
ALYacGen:Variant.Symmi.4437
APEXMalicious
AVGWin32:Evo-gen [Trj]
AlibabaBackdoor:Win32/Poison.436b9313
Antiy-AVLTrojan[APT]/Win32.APT10
ArcabitTrojan.Symmi.D1155
AvastWin32:Evo-gen [Trj]
AviraTR/Crypt.ZPACK.Gen
BitDefenderGen:Variant.Symmi.4437
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.Injector.S7380560
CTXexe.trojan.poison
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
CynetMalicious (score: 99)
DeepInstinctMALICIOUS
DrWebTrojan.DownLoader9.39293
ESET-NOD32Win32/Poison.NLC
Elasticmalicious (high confidence)
EmsisoftGen:Variant.Symmi.4437 (B)
F-SecureTrojan.TR/Crypt.ZPACK.Gen
FireEyeGeneric.mg.4f505ca0ea4540e6
FortinetW32/Malware_fam.NB
GDataGen:Variant.Symmi.4437
GoogleDetected
IkarusTrojan.Win32.Agent
JiangminTrojanDropper.Injector.bqva
K7AntiVirusTrojan ( 004ecbb71 )
K7GWTrojan ( 004ecbb71 )
KasperskyTrojan-Dropper.Win32.Injector.juwy
Kingsoftmalware.kb.a.987
LionicTrojan.Win32.Poison.b!c
MalwarebytesGeneric.Malware/Suspicious
MaxSecureTrojan.Malware.8769756.susgen
McAfeeBackDoor-FBSQ!4F505CA0EA45
McAfeeDti!44A7BEA8A08F
MicroWorld-eScanGen:Variant.Symmi.4437
MicrosoftBackdoor:Win32/Poison.CE
NANO-AntivirusTrojan.Win32.Inject.cwizra
Paloaltogeneric.ml
PandaGeneric Malware
RisingDropper.Injector!8.DC (TFE:5:VaRVn489Ks)
SangforBackdoor.Win32.Poison.Vt3b
SentinelOneStatic AI - Suspicious PE
SkyhighBackDoor-FBSQ!4F505CA0EA45
SophosMal/Generic-S
SymantecBackdoor.Trojan
TencentMalware.Win32.Gencirc.13c186b9
Trapminemalicious.moderate.ml.score
TrendMicroBKDR_POISON.TUHE
TrendMicro-HouseCallBKDR_POISON.TUHE
VBA32Backdoor.Win32.Hupigon.dguz
VIPREGen:Variant.Symmi.4437
VaristW32/Trojan.DJLU-2710
ViRobotTrojan.Win32.Z.Injector.61440.AH
VirITTrojan.Win32.Dnldr9.CGDH
XcitiumMalware@#3mt4cwxcsi0y7
YandexTrojan.DR.Injector!MistrLQCzag
ZillyaDropper.Injector.Win32.66142
alibabacloudBackdoor:Win/Poison.NEI
huorongHVM:Trojan/Injector.gen!A
tehtrisGeneric.Malware

DNS requests

fbi.sexxxy.biz

Process list

NameCommand line
44a7bea8a08f4c2feb74c6a00ff1114ba251f3dc6922ea5ffab9e749c98cbdce.exe
4f505ca0ea4540e6662def1c1ddadd03.exe
4f505ca0ea4540e6662def1c1ddadd03.exe