lsass.exe
Classification: Malicious
lsass.exe is a trojan (Windows executable, 607.5 KB). Flagged by 67% of antivirus engines (71 detections). Linked to Guloader malware.
Detection summary
- 71 antivirus detections (67% detection ratio)
- 0 IDS alerts
- 1 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: GULOADER (S0561)
Intrusion sets: APT37 (G0067)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Apt37 | Maltiverse | 2023-07-04 04:28:54 | 2023-07-05 20:50:48 | malicious-activity | G0067 APT37 |
| Generic Malware | Hybrid-Analysis | 2023-06-30 01:21:56 | 2023-06-30 01:21:56 | ||
| GuLoader | MalwareBazaar Abuse.ch | 2023-06-20 04:51:34 | 2023-06-20 04:51:34 | malicious-activity | S0561 GuLoader |
Tags
aptSample information
- Filenames
- ad85442ee6ba3f66771fbc0adf5de628, lsass.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows, ...
- Size
- 622056 bytes
- MD5
ad85442ee6ba3f66771fbc0adf5de628- SHA-1
91e91bde708cdd2ba711127ed3c34d37256e3f43- SHA-256
4f9b11af442f37c160f98dd09d12ee0c138d1dcdb1350fc16b8bc6191bbe4aea- First indexed
- 2023-06-20 06:18:14
- Last updated
- 2025-11-24 05:18:49
Antivirus detections
| Engine | Detection |
|---|---|
| Bkav | W32.AIDetectMalware |
| Lionic | Trojan.Win32.Androm.ts6W |
| MicroWorld-eScan | Gen:Variant.Tedy.383016 |
| CAT-QuickHeal | Trojandownloader.Minix |
| ALYac | Gen:Variant.Tedy.383016 |
| Malwarebytes | Trojan.GuLoader |
| Sangfor | Downloader.Win32.Agent.Vahb |
| K7AntiVirus | Trojan ( 005a6f571 ) |
| Alibaba | TrojanDownloader:Win32/Minix.0cd85fa2 |
| K7GW | Trojan ( 005a6f571 ) |
| CrowdStrike | win/malicious_confidence_90% (W) |
| Arcabit | Trojan.Tedy.D5D828 |
| Cyren | W32/ABRisk.SLLB-6547 |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | NSIS/Injector.BXG |
| APEX | Malicious |
| Kaspersky | HEUR:Trojan-Downloader.Win32.Minix.gen |
| BitDefender | Gen:Variant.Tedy.383016 |
| Avast | Win32:Evo-gen [Trj] |
| Tencent | Win32.Trojan.FalseSign.Oqil |
| Emsisoft | Gen:Variant.Tedy.383016 (B) |
| DrWeb | Trojan.Inject4.58376 |
| VIPRE | Gen:Variant.Tedy.383016 |
| TrendMicro | Trojan.Win32.GULOADER.YXDFMZ |
| McAfee-GW-Edition | RDN/Generic Downloader.x |
| FireEye | Gen:Variant.Tedy.383016 |
| Sophos | Mal/Generic-S |
| Detected | |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| ZoneAlarm | HEUR:Trojan-Downloader.Win32.Minix.gen |
| GData | Gen:Variant.Tedy.383016 |
| AhnLab-V3 | Downloader/Win.GuLoader.C5440513 |
| McAfee | RDN/Generic Downloader.x |
| MAX | malware (ai score=85) |
| Cylance | unsafe |
| Panda | Trj/Chgt.AD |
| TrendMicro-HouseCall | Trojan.Win32.GULOADER.YXDFMZ |
| Ikarus | Trojan.NSIS.Agent |
| Fortinet | W32/BXG!tr |
| AVG | Win32:Evo-gen [Trj] |
| DeepInstinct | MALICIOUS |
| Alibaba | TrojanDownloader:Win32/Minix.2e9ce975 |
| Avira | HEUR/AGEN.1368523 |
| CTX | exe.trojan.minix |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 99) |
| F-Secure | Heuristic.HEUR/AGEN.1368523 |
| Fortinet | NSIS/Injector.CCM!tr |
| Ikarus | Trojan.PowerShell.Agent |
| Kingsoft | Win32.Troj.Generic.v |
| Lionic | Trojan.Win32.Minix.a!c |
| Malwarebytes | Malware.AI.2976240182 |
| McAfeeD | ti!4F9B11AF442F |
| Microsoft | Trojan:Win32/Tedy.AMAB!MTB |
| NANO-Antivirus | Trojan.Win32.Inject4.jwxnky |
| Paloalto | generic.ml |
| Sangfor | Downloader.Win32.Tedy.Vl9i |
| Skyhigh | NSIS/Injector.o |
| Symantec | Scr.NSISHeur!gen3 |
| TrellixENS | Artemis!AD85442EE6BA |
| TrendMicro | TROJ_GEN.R06EC0DI225 |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04C9n |
| VBA32 | TrojanDownloader.Minix |
| Varist | W32/ABRisk.SLLB-6547 |
| VirIT | Trojan.Win32.Genus.RMI |
| Xcitium | Malware@#2zuf79hizy4wx |
| Zillya | Downloader.Minix.Win32.1036 |
| alibabacloud | Trojan[downloader]:Win/Tedy.AZZJ3DGW |
| huorong | Trojan/Injector.bcx |
Process list
| Name | Command line |
|---|---|
| lsass.exe | |