FF-1642523664.xll

Classification: Malicious

FF-1642523664.xll is a trojan (application/x-dosexec, 1.7 MB). Flagged by 26% of antivirus engines (38 detections). Linked to Bazar malware.

Detection summary

  • 38 antivirus detections (26% detection ratio)
  • 0 IDS alerts
  • 5 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: BAZAR (S0534)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
BazaLoader MalwareBazaar Abuse.ch 2022-01-20 07:50:11 2022-01-20 07:50:11 malicious-activity S0534 Bazar

Sample information

Filenames
80060b128b6d4813f184d33b53972dea, FF-1642523664.xll
File type
application/x-dosexec
Size
1816064 bytes
MD5
80060b128b6d4813f184d33b53972dea
SHA-1
f3bd01cd5ac96d660ec90ad1b81c5d6923978909
SHA-256
4db56cc519b8fe92f608a30bf32477b62c1f154de183e7f075bb4cf68e918a83
First indexed
2022-01-18 17:31:36
Last updated
2026-04-30 03:20:31

Antivirus detections

EngineDetection
LionicTrojan.Win32.Tedy.4!c
CynetMalicious (score: 100)
ALYacGen:Variant.Mikey.133589
MalwarebytesTrojan.Bazar
K7AntiVirusTrojan ( 0058cf5d1 )
BitDefenderGen:Variant.Mikey.133589
K7GWTrojan ( 0058cf5d1 )
CyrenW64/Bazarldr.J.gen!Eldorado
ESET-NOD32a variant of Win64/Agent.BBE
KasperskyUDS:DangerousObject.Multi.Generic
MicroWorld-eScanGen:Variant.Mikey.133589
TencentMalware.Win32.Gencirc.11e44c9d
Ad-AwareGen:Variant.Mikey.133589
SophosMal/Generic-S + Mal/Agent-AWW
McAfee-GW-EditionArtemis!Trojan
FireEyeGen:Variant.Mikey.133589
EmsisoftTrojan.Agent (A)
AviraTR/Agent.rucpn
KingsoftWin32.Troj.Generic_a.a.(kcloud)
MicrosoftTrojan:Script/Phonzy.B!ml
ArcabitTrojan.Mikey.D209D5
GDataGen:Variant.Mikey.133589
AhnLab-V3Trojan/Win.Generic.C4909878
McAfeeArtemis!80060B128B6D
MAXmalware (ai score=80)
TrendMicro-HouseCallTROJ_GEN.R002H09AI22
RisingTrojan.Agent!8.B1E (CLOUD)
YandexTrojan.Agent!QvVs6TlV9QA
IkarusTrojan.Win64.Agent
MaxSecureTrojan.Malware.300983.susgen
FortinetW64/Agent.BBE!tr
AVGWin64:MalwareX-gen [Trj]
AvastWin64:MalwareX-gen [Trj]
DrWebTrojan.Siggen16.37094
McAfeeBazar-FTWR!80060B128B6D
SymantecTrojan.Gen.MBT
SophosMal/Generic-R + Mal/Agent-AWW
MicrosoftTrojan:Script/Phonzy.C!ml

Process list

NameCommand line
<Ignored Process>
rundll32.exe"C:\FF-1642523664.xll.dll",#1
rundll32.exe"C:\FF-1642523664.xll.dll",#2
rundll32.exe"C:\FF-1642523664.xll.dll",#3
rundll32.exe"C:\FF-1642523664.xll.dll",#4