svchost.exe

Classification: Malicious

svchost.exe is a malicious file sample. Linked to Pysa malware. Reported by 2 threat sources, last seen 2021-01-05. Detected by 50 antivirus engines.

Detection summary

  • 50 antivirus detections (50% detection ratio)
  • 0 IDS alerts
  • 1 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: PYSA (S0583)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Mespinoza Abuse.ch 2021-01-05 19:37:30 2021-01-05 19:37:30 malicious-activity S0583 Pysa
Generic.Ransom.Mespinoza Hybrid-Analysis 2021-01-05 10:45:19 2021-01-05 10:45:19

Sample information

Filenames
svchost.exe, 4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b.bin
File type
application/x-dosexec
Size
512000 bytes
MD5
83e1ca89bcd55a87f826bc6901ff7f3e
SHA-1
d0db4d232331234f0c430008a4320c0dea993c20
SHA-256
4dc802894c45ec4d119d002a7569be6c99a9bba732d0057364da9350f9d3659b
First indexed
2021-01-05 10:45:19
Last updated
2026-04-17 14:46:01

Antivirus detections

EngineDetection
BkavW32.AIDetectVM.malware2
Qihoo-360Win32/Trojan.109
ALYacGeneric.Ransom.Mespinoza.3ADCC5D8
CylanceUnsafe
SangforMalware
K7AntiVirusTrojan ( 0055d5e81 )
AlibabaRansom:Win32/generic.ali2000010
K7GWTrojan ( 0055d5e81 )
CrowdStrikewin/malicious_confidence_100% (W)
CyrenW32/Ransom.MLJU-2573
SymantecRansom.Gen
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Zudochka.gen
BitDefenderGeneric.Ransom.Mespinoza.3ADCC5D8
MicroWorld-eScanGeneric.Ransom.Mespinoza.3ADCC5D8
AvastWin32:RansomX-gen [Ransom]
Ad-AwareGeneric.Ransom.Mespinoza.3ADCC5D8
EmsisoftGeneric.Ransom.Mespinoza.3ADCC5D8 (B)
Comodo.UnclassifiedMalware@0
DrWebTrojan.Encoder.32290
TrendMicroRansom.Win32.MESPINOZA.SMDA
McAfee-GW-EditionGenericRXMV-OX!83E1CA89BCD5
FireEyeGeneric.mg.83e1ca89bcd55a87
SophosMal/Generic-S
IkarusTrojan-Ransom.FileCrypter
JiangminTrojan.Zudochka.iv
WebrootW32.Malware.Gen
AviraTR/FileCoder.puqfs
MicrosoftRansom:Win32/Filecoder.PD!MTB
ArcabitGeneric.Ransom.Mespinoza.3ADCC5D8
AegisLabTrojan.Win32.Zudochka.4!c
ZoneAlarmHEUR:Trojan.Win32.Zudochka.gen
GDataGeneric.Ransom.Mespinoza.3ADCC5D8
AhnLab-V3Malware/Win32.Generic.C4289671
McAfeeGenericRXMV-OX!83E1CA89BCD5
MAXmalware (ai score=100)
MalwarebytesRansom.Mespinoza
ESET-NOD32a variant of Win32/Filecoder.NYO
TrendMicro-HouseCallRansom.Win32.MESPINOZA.SMDA
RisingRansom.Agent!1.C222 (CLASSIC)
YandexTrojan.GenAsa!qoUkCes1Sac
eGambitUnsafe.AI_Score_94%
FortinetW32/Filecoder.NYO!tr.ransom
BitDefenderThetaGen:NN.ZexaF.34742.FCW@aWAyCUai
AVGWin32:RansomX-gen [Ransom]
Cybereasonmalicious.9bcd55
PandaTrj/GdSda.A
MaxSecureTrojan.Malware.121218.susgen

Process list

NameCommand line
svchost.exe