Classification: Malicious
DeriaLock.exe is a ransomware (Windows executable, 484.0 KB). Flagged by 80% of antivirus engines (56 detections). Linked to Wiper malware.
Detection summary
- 56 antivirus detections (80% detection ratio)
- 1 IDS alerts
- 4 processes observed
- 1 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Suspicious Sample |
Triage |
2026-09-06 16:13:06 |
2026-09-06 16:13:06 |
anomalous-activity
|
|
| Generic Malware |
Hybrid-Analysis |
2025-07-27 15:15:04 |
2025-07-27 18:20:39 |
|
|
| Ransomware |
VM-Ray |
2022-08-31 21:19:39 |
2022-08-31 21:19:39 |
|
|
| Wiper |
VM-Ray |
2022-08-31 21:19:39 |
2022-08-31 21:19:39 |
|
S0041 Wiper
|
Tags
ransomware
windows-server-utility
discovery
persistence
privilege_escalation
Sample information
- Filenames
- DeriaLock.exe, 4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309.exe, file
- File type
- PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
- Size
- 495616 bytes
- MD5
0a7b70efba0aa93d4bc0857b87ac2fcb- SHA-1
01a6c963b2f5f36ff21a1043587dcf921ae5f5cd- SHA-256
4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309- First indexed
- 2021-10-02 14:33:57
- Last updated
- 2026-09-06 16:56:55
Antivirus detections
| Engine | Detection |
|---|
| Lionic | Trojan.Win32.Gen.j!c |
| Elastic | malicious (high confidence) |
| MicroWorld-eScan | Trojan.GenericKD.46550725 |
| CAT-QuickHeal | Ransom.DeriaLock.A4 |
| Qihoo-360 | Win32/Ransom.Genasom.HwMAEpsA |
| McAfee | GenericRXFC-JO!0A7B70EFBA0A |
| Cylance | Unsafe |
| Zillya | Trojan.Gen.Win32.591 |
| Sangfor | Ransom.MSIL.Filecoder.DP |
| K7AntiVirus | Trojan ( 700000121 ) |
| Alibaba | Ransom:Win32/Dereilock.b924c58c |
| K7GW | Trojan ( 700000121 ) |
| Cybereason | malicious.fba0aa |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | MSIL/Filecoder.DP |
| APEX | Malicious |
| Paloalto | generic.ml |
| Kaspersky | Trojan-Ransom.Win32.Gen.bbf |
| BitDefender | Trojan.GenericKD.46550725 |
| NANO-Antivirus | Trojan.Win32.Filecoder.ekblsj |
| Avast | MSIL:Ransom-T [Trj] |
| Ad-Aware | Trojan.GenericKD.46550725 |
| Comodo | Malware@#2iy8bzi5afc9g |
| DrWeb | Trojan.Encoder.7466 |
| VIPRE | Trojan.Win32.Generic!BT |
| TrendMicro | Ransom_DERIALOCK.D |
| McAfee-GW-Edition | GenericRXFC-JO!0A7B70EFBA0A |
| FireEye | Generic.mg.0a7b70efba0aa93d |
| Emsisoft | Trojan.FileCoder (A) |
| SentinelOne | Static AI - Malicious PE |
| GData | Trojan.GenericKD.46550725 |
| Jiangmin | Trojan.Gen.aiq |
| Webroot | W32.Ransom.Gen |
| Avira | TR/Genasom.wzara |
| MAX | malware (ai score=100) |
| Antiy-AVL | Trojan/Generic.ASMalwS.1E03F06 |
| Kingsoft | Win32.Troj.GenericKD.v.(kcloud) |
| Gridinsoft | Ransom.Win32.Ransom.ns |
| Arcabit | Trojan.Generic.D2C64EC5 |
| Microsoft | Ransom:Win32/Dereilock |
| Cynet | Malicious (score: 99) |
| AhnLab-V3 | Trojan/Win32.Ransom.C1724822 |
| VBA32 | Hoax.Gen |
| ALYac | Trojan.Ransom.DeriaLock |
| TACHYON | Ransom/W32.DN-Agent.495616 |
| Malwarebytes | Ransom.DeriaLock |
| TrendMicro-HouseCall | Ransom_DERIALOCK.D |
| Tencent | Win32.Trojan.Gen.Glv |
| Yandex | Trojan.Gen!krW2TG6S8Rk |
| Ikarus | Trojan-Ransom.ArioznaCode |
| Fortinet | MSIL/Filecoder.DP!tr.ransom |
| BitDefenderTheta | Gen:NN.ZemsilF.34050.Eq0@aWATY2e |
| AVG | MSIL:Ransom-T [Trj] |
| Panda | Trj/GdSda.A |
| CrowdStrike | win/malicious_confidence_100% (W) |
| MaxSecure | Trojan.Malware.74458157.susgen |
Process list
| Name | Command line |
|---|
| DeriaLock.exe | |
| wermgr.exe | -queuereporting |
| RunDll32.exe | "%WINDIR%\system32\WerConCpl.dll", LaunchErcApp -queuereporting |
| file.exe | |