cone.exe.zip
Classification: Malicious
cone.exe.zip is a trojan. Detected by 53 antivirus engines. Linked to Chaos, Asyncrat malware. 80 sightings from Triage, last seen 2026-10-05.
Detection summary
- 53 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: CHAOS (S0220) ASYNCRAT (S1087) COBALT STRIKE (S0154) AMADEY (S1025)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Ades_stealer | Triage | 2026-04-30 18:02:34 | 2026-10-05 17:33:09 | malicious-activity | |
| Acrstealer | Triage | 2026-08-18 15:41:57 | 2026-10-04 19:30:06 | malicious-activity | |
| 44caliber | Triage | 2026-06-06 12:46:46 | 2026-09-27 14:21:29 | malicious-activity | |
| Amadey | Triage | 2026-06-11 22:26:44 | 2026-08-26 22:44:31 | malicious-activity | S1025 Amadey |
| Cobalt Strike | Triage | 2026-05-07 20:49:18 | 2026-08-15 20:56:40 | malicious-activity | S0154 Cobalt Strike |
| Asyncrat | Triage | 2026-05-07 22:42:17 | 2026-08-11 16:30:54 | malicious-activity | S1087 AsyncRAT |
| Chaos | Triage | 2026-02-02 19:17:28 | 2026-07-23 01:19:26 | malicious-activity | S0220 Chaos |
| Blankgrabber | Triage | 2026-06-25 15:24:51 | 2026-06-25 15:24:51 | malicious-activity | |
| Adaptixc2 | Triage | 2026-04-30 21:17:05 | 2026-05-04 15:46:16 | malicious-activity | |
| Masslogger | Triage | 2026-03-26 20:58:47 | 2026-03-26 20:58:47 | malicious-activity | |
| Discordrat | Triage | 2026-02-02 15:37:17 | 2026-03-22 03:05:28 | malicious-activity | |
| Xorist | Triage | 2026-03-21 20:41:31 | 2026-03-21 20:41:31 | malicious-activity | |
| Valleyrat_s2 | Triage | 2026-03-18 15:55:34 | 2026-03-18 15:55:34 | malicious-activity | |
| Destiny_stealer | Triage | 2026-02-02 15:37:17 | 2026-02-02 15:37:17 | malicious-activity |
Tags
ades_stealer amadey asyncrat blankgrabber chaos cobaltstrike dcrat destiny_stealer discordrat dragonforce gcleaner gh0strat jlocker lockbit masslogger metasploit mimikatz modiloader mylobot onlylogger quasar redline rokrat salatstealer sectoprat sliver svcstealer umbral valleyrat_s2 vidar vipkeylogger wannacry xorist xred xworm 1359593325 158fdd2a4f5abb978509580715e5353f 21012026 987654321 cheat ddwwnnll default fbf543 fc155c5bf8a148a93a2ba17de68393f0n loaded office04 runtimebroker rif0lm aspackv2 backdoor botnet collection credential_access defense_evasion discovery downloader execution impact infostealer installer keylogger loader macro miner persistence privilege_escalation pyinstaller ransomware rat revoked_codesign rootkit spyware stealer trojan upx worm nanocore neshta raworld warzonerat wshrat bootkit evasion adware infinitylock mythicapollo njrat rustme stealc beyond d0c8326566bc246a11d6ea815150d612 d42c87a43c34a896249c7907eb2c4c26 fff google chrome exploit rhadamanthys stealerium 100000000 themida adaptixc2 ammyyadmin deerstealer donutloader flawedammyy hackbrowserdata hijackloader jigsaw koiloader aquarius ddns livetraffoc suricata 0 netsupport gurcu ramnit banker emotet hiddentear risepro xmrig 1b2025 lokibot lumma snappyclient first 44caliber needle_stealer petya phorphiex remcos remus_stealer xenorat paydaytry prueba exelastealer revengerat roningloader spam dragon_breath apt crash stormkitty dharma hive purplefox supershell costura packer formbook xx vmprotect cryptolocker sharphound hacktool r_n_t xtinyloader medusaransomware sheetrat ratonrat client r909 redosdru 30e82a36fe6be8301f209eb26300f90d 391144938 hacked jesus christ remotehostupx animateclipper build clipper 292234 a66537 run blackmatter troldesh 666666 trupashot siriusrat 2ae1b557d5f1fe6ab80db53367735250 geforce fleshstealer killmbr wiper phantom_stealer acrstealer vshell remotehost command_and_control 20260831 666666666 nightwire solaris_loader a099505f8ec3a0db21363b9cf5631705 c9e9a8ce47eb529601c1bb8d8883edb4 nexus 31-08-2026 5fdb6df778631818165110294c620890 3bc41b1aa7524456de3f85c8d329d639 aokigahara 4a9d4a401684fc862456f0d14966ac04c05c544bf406bbda607937bb570cd489 df2f990b892ca7a21378cd581ca56d4dn el chapo 2959cad4 overlord bridgeagent 2bbaef9e7d6fe2cffe83045e5aef3f94 51d8e58cd2d7a2ccdffccd1d42246875 b8a12d54f77e31372dac9fd44402f8b26111c337a114961bd75984ccb9a508a3 casinohouse.co e657b21a09fa9c2ef09c5f9e2d07bf3e f9dc77f081d75353c01ce9bb8742b816 forsell.tech main-tg88.store pago ryanmorales.me tg88seru.me vn789win.top vsbet-official.com f6d8815bSample information
- Filenames
- cone.exe.zip, ripper.zip
- MD5
5e4a348e89afb91e6ae698f3104f7b47- SHA-1
1ea7e4faa29e2803f50165f63815003fe22b8cbd- SHA-256
4e5cebe1908e12e8a4ed1198fb01fb87871dbe54847855b11b3540dbc47bbe88- SHA-512
a4282f90cff85a5802c551c770b2e849ef745bbde8c707d6878c841102d98bdcfe86c014df2acf34fb4471713d990265d0eaaf129dd560898785b8e7ebc53666- First indexed
- 2026-02-02 15:37:17
- Last updated
- 2026-10-05 17:57:31
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Gen:Variant.Midie.165163 |
| AVG | Win32:MalwareX-gen [Misc] |
| Acronis | suspicious |
| AhnLab-V3 | Malware/Win.Themida.R728354 |
| Alibaba | Backdoor:Win32/DarkKomet.353 |
| Antiy-AVL | Trojan[Dropper]/Win32.Dapato |
| Arcabit | Trojan.Zusy.D920DD [many] |
| Avast | Win32:MalwareX-gen [Misc] |
| Avira | TR/Crypt.XPACK.Gen |
| Baidu | Win32.Trojan.WannaCry.c |
| BitDefender | Gen:Variant.Zusy.598237 |
| CAT-QuickHeal | Trojan.Ghanarava.17618133297d2a46 |
| CTX | zip.trojan.generic |
| ClamAV | Win.Trojan.Emotet-9850453-0 |
| Cynet | Malicious (score: 99) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Siggen31.59137 |
| ESET-NOD32 | multiple detections |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Variant.Zusy.598237 (B) |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen |
| Fortinet | W32/PossibleThreat |
| GData | Win32.Backdoor.XRedRAT.A |
| Gridinsoft | Malware.U.Gen.tr |
| Ikarus | Trojan-Ransom.WannaCry |
| Jiangmin | Trojan.Generic.hulzb |
| K7AntiVirus | Riskware ( 005cdebc1 ) |
| K7GW | Riskware ( 005cdebc1 ) |
| Kaspersky | Backdoor.Win32.DarkKomet.hqxy |
| Kingsoft | malware.kb.c.791 |
| Lionic | Trojan.ZIP.Themida.m!c |
| MaxSecure | Trojan.Malware.332854184.susgen |
| NANO-Antivirus | Trojan.Win32.DarkKomet.fazbwq |
| Panda | Trj/CI.A |
| Sangfor | Suspicious.Win32.Save.a |
| SentinelOne | Static AI - Malicious Archive |
| Sophos | Mal/Wanna-A |
| Symantec | Trojan.Gen.NPE |
| Tencent | Win32.Trojan.Generic.Nqil |
| TrellixENS | Artemis!001E8AD1E0D0 |
| TrendMicro | Trojan.Win32.AMADEY.YXFI4Z |
| TrendMicro-HouseCall | Trojan.Win32.AMADEY.YXFI4Z |
| VBA32 | TScope.Malware-Cryptor.SB |
| VIPRE | Gen:Variant.Zusy.598237 |
| Varist | W32/Themida.S.gen!Eldorado |
| VirIT | Trojan.Win64.Genus.IME |
| Webroot | Win.Trojan.Gen |
| Xcitium | Malware@#207vp5khzn30o |
| Zillya | Trojan.Themida.Win32.159977 |
| ZoneAlarm | Mal/Wanna-A |
| Zoner | Trojan.DOC.132395 |
| alibabacloud | RansomWare:Win/Wannacryptor.367ee853 |
| huorong | Virus/Synares.a$SA |