000.exe
Classification: Malicious
000.exe is a malicious file sample (Windows executable, 6.7 MB). Linked to Wiper malware. 44 sightings from 4 threat sources, last seen 2026-10-14.
Detection summary
- 0 antivirus detections
- 0 IDS alerts
- 17 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: WIPER (S0041)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Suspicious Sample | Triage | 2026-08-07 18:25:33 | 2026-10-14 03:42:44 | anomalous-activity | |
| Generic Malware | Cyber Threat Alliance | 2026-09-04 04:02:15 | 2026-09-04 04:02:15 | malicious-activity | |
| Generic Malware | Triage | 2026-02-06 00:33:02 | 2026-07-27 13:49:21 | malicious-activity | |
| Generic Malware | Hybrid-Analysis | 2024-02-15 07:30:03 | 2024-06-11 03:45:14 | ||
| Keylogger | VM-Ray | 2023-06-08 13:22:35 | 2023-06-08 13:22:35 | ||
| Wiper | VM-Ray | 2023-06-08 13:22:35 | 2023-06-08 13:22:35 | S0041 Wiper |
Tags
evasive defense_evasion discovery persistence ransomware executionSample information
- Filenames
- 000.exe, мисс мажор.exe, [email protected], [email protected], lunch.bin, Trojan.000.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 6983680 bytes
- MD5
f2b7074e1543720a9a98fda660e02688- SHA-1
1029492c1a12789d8af78d54adcb921e24b9e5ca- SHA-256
4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966- SHA-512
73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff- First indexed
- 2023-06-08 11:16:05
- Last updated
- 2026-09-04 04:02:15
Process list
| Name | Command line |
|---|---|
| lunch.bin.exe | |
| cmd.exe | /c ""%TEMP%\windl.bat"" |
| taskkill.exe | taskkill /f /im explorer.exe |
| taskkill.exe | taskkill /f /im taskmgr.exe |
| WMIC.exe | wmic useraccount where name='LgyMGor' set FullName='UR NEXT' |
| WMIC.exe | wmic useraccount where name='LgyMGor' rename 'UR NEXT' |
| shutdown.exe | shutdown /f /r /t 0 |
| lunch.bin.exe | |
| cmd.exe | /c ""%TEMP%\windl.bat"" |
| taskkill.exe | taskkill /f /im explorer.exe |
| taskkill.exe | taskkill /f /im taskmgr.exe |
| WMIC.exe | wmic useraccount where name='hhNfXyV' set FullName='UR NEXT' |
| WMIC.exe | wmic useraccount where name='hhNfXyV' rename 'UR NEXT' |
| shutdown.exe | shutdown /f /r /t 0 |
| WerFault.exe | -u -p 5280 -s 1008 |
| WerFault.exe | -u -p 5280 -s 1008 |
| mono-sgen | mono /home/ubuntu/Trojan.000.exe |