$RNL3V1B.exe

Classification: Malicious

$RNL3V1B.exe is a trojan (Windows 64-bit executable, 9.7 MB). Detected by 84 antivirus engines. Linked to Lazagne malware. 32 sightings, last seen 2026-08-20.

Detection summary

  • 84 antivirus detections
  • 0 IDS alerts
  • 29 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: LAZAGNE (S0349)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Lazagne Triage 2026-07-01 18:25:30 2026-08-20 10:31:57 malicious-activity S0349 LaZagne
Generic Malware Hybrid-Analysis 2024-06-26 03:30:04 2025-01-31 06:45:10
Generic.Malware MalwareBazaar Abuse.ch 2024-08-05 09:02:51 2024-08-05 09:02:51 malicious-activity

Tags

infostealer qakbot lazagne adware collection credential_access hacktool persistence pyinstaller ransomware spyware stealer execution

Sample information

Filenames
$RNL3V1B.exe, lazanya.exe, temp_LaZagne.exe, LaZagne.exe, LaZagne_3.exe, l.exe
File type
PE32+ executable (console) x86-64, for MS Windows
Size
10132516 bytes
MD5
5075f994390f9738e8e69f4de09debe6
SHA-1
a3fad01a0c10fde5b38267188860ea1da649697d
SHA-256
467e49f1f795c1b08245ae621c59cdf06df630fc1631dc0059da9a032858a486
First indexed
2024-06-26 03:15:12
Last updated
2026-08-20 10:55:46

Antivirus detections

EngineDetection
ALYacGeneric.Application.Lazagne.E.F9B497F2
APEXMalicious
AVGWin64:Malware-gen
AlibabaHackTool:Win32/Almi_LaZagne.b
ArcabitGeneric.Application.Lazagne.E.F9B497F2
AvastWin64:Malware-gen
BitDefenderGeneric.Application.Lazagne.E.F9B497F2
ClamAVWin.Trojan.Lazagne-6779429-0
CrowdStrikewin/malicious_confidence_60% (W)
Cybereasonmalicious.4390f9
DeepInstinctMALICIOUS
ESET-NOD32multiple detections
Elasticmalicious (moderate confidence)
EmsisoftGeneric.Application.Lazagne.E.F9B497F2 (B)
FireEyeGeneric.Application.Lazagne.E.F9B497F2
FortinetRiskware/LaZagne
GDataGeneric.Application.Lazagne.E.F9B497F2
GoogleDetected
GridinsoftVirtool.Win64.Heur.sa
KasperskyTrojan-PSW.Win32.Stealer.cfwh
KingsoftWin32.Trojan-PSW.Stealer.cfwh
LionicTrojan.Win32.Lazagne.i!c
MAXmalware (ai score=82)
MalwarebytesMalware.AI.2681500992
MaxSecureTrojan.Malware.257303294.susgen
McAfeeArtemis!5075F994390F
McAfeeDti!467E49F1F795
MicroWorld-eScanGeneric.Application.Lazagne.E.F9B497F2
MicrosoftProgram:Win32/Wacapew.C!ml
Paloaltogeneric.ml
PandaTrj/CI.A
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win64.BadFile.tc
SophosATK/LaZagne-N
SymantecPUA.Gen.2
TencentWin32.Trojan-QQPass.QQRob.Anhl
TrendMicroHackTool.Win64.LaZagne.SM
VIPREGeneric.Application.Lazagne.E.F9B497F2
VaristW64/ABApplication.BIGU-0156
WebrootW32.HackTool.Gen
ZoneAlarmTrojan-PSW.Win32.Stealer.cfwh
alibabacloudHacktool:Python/laZagne
ALYacMisc.HackTool.LaZagne
AhnLab-V3HackTool/Win.LaZagne.C5652206
ArcabitTrojan.Clyp.11
AviraSPR/LaZagne.467e49
BitDefenderGen:Heur.Clyp.11
BkavW64.AIDetectMalware
CAT-QuickHealRiskWare.LaZagneCiR
CTXexe.trojan.lazagne
CylanceUnsafe
CynetMalicious (score: 99)
DrWebTool.LaZagne.18
ESET-NOD32Python/Riskware.LaZagne.Q
Elasticmalicious (high confidence)
EmsisoftGen:Heur.Clyp.11 (B)
F-SecurePrivacyRisk.SPR/LaZagne.467e49
FireEyeGen:Heur.Clyp.11
GDataGen:Heur.Clyp.11
IkarusTrojan.Win32
K7AntiVirusTrojan ( 005b844e1 )
K7GWTrojan ( 005b844e1 )
LionicTrojan.Win32.LaZagne.i!c
MalwarebytesHackTool.LaZagne
McAfeeGeneric-.q
MicroWorld-eScanGen:Heur.Clyp.11
MicrosoftHackTool:Win32/LaZagne
SangforRiskware.Win32.Lazagne.Vh5m
SkyhighBehavesLike.Win64.Downloader.tc
VBA32TrojanPSW.Stealer
VIPREGen:Heur.Clyp.11
VirITTrojan.Win64.Genus.HCV
XcitiumApplicUnwnt@#14l9ad27n02fg
huorongHackTool/Python.LaZagne.c
Antiy-AVLHackTool/Win32.Lazagne
CAT-QuickHealTrojan.Ghanarava.17488614659debe6
CrowdStrikewin/malicious_confidence_100% (W)
NANO-AntivirusTrojan.Win64.Stealer.kuhczv
RisingHackTool.Lazagne/PYC!1.100FF (CLASSIC)
SkyhighBehavesLike.Win64.Agent.tc
TrellixENSGeneric-.q
TrendMicro-HouseCallHackTool.Win64.LaZagne.SM
ZoneAlarmATK/LaZagne-N

Process list

NameCommand line
temp_LaZagne.exe
temp_LaZagne.exe
LaZagne.exe
LaZagne.exe
cmd.exe/c "ver"
cmd.exe/c "reg.exe save hklm\sam %TEMP%\hnukhffsvyt"
reg.exesave hklm\sam %TEMP%\hnukhffsvyt
cmd.exe/c "reg.exe save hklm\security %TEMP%\prixmpdowz"
reg.exesave hklm\security %TEMP%\prixmpdowz
cmd.exe/c "reg.exe save hklm\system %TEMP%\dnscuijhv"
reg.exesave hklm\system %TEMP%\dnscuijhv
LaZagne_3.exe
LaZagne_3.exe
cmd.exe/c "ver"
cmd.exe/c "reg.exe save hklm\sam %TEMP%\fpkxcm"
reg.exesave hklm\sam %TEMP%\fpkxcm
cmd.exe/c "reg.exe save hklm\security %TEMP%\biugdzw"
reg.exesave hklm\security %TEMP%\biugdzw
cmd.exe/c "reg.exe save hklm\system %TEMP%\tehvfzmytooc"
reg.exesave hklm\system %TEMP%\tehvfzmytooc
LaZagne_3.exe
LaZagne_3.exe
cmd.exe/c "ver"
cmd.exe/c "reg.exe save hklm\sam %TEMP%\vavbdy"
reg.exesave hklm\sam %TEMP%\vavbdy
cmd.exe/c "reg.exe save hklm\security %TEMP%\iyvwisaiu"
reg.exesave hklm\security %TEMP%\iyvwisaiu
cmd.exe/c "reg.exe save hklm\system %TEMP%\yxklvjt"
reg.exesave hklm\system %TEMP%\yxklvjt