5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd.exe

Classification: Malicious

5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd.exe is a malicious file sample. Reported by 5 threat sources, last seen 2026-09-02.

Detection summary

  • 52 antivirus detections
  • 1 IDS alerts
  • 19 processes observed
  • 2 contacted hosts
  • 1 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Suspicious Sample Triage 2026-09-02 10:16:23 2026-09-02 10:16:23 anomalous-activity
Generic Malware Cyber Threat Alliance 2026-08-27 10:13:37 2026-08-27 10:13:37 malicious-activity
Generic Malware Hybrid-Analysis 2025-01-17 12:15:05 2025-06-06 22:00:05
Unknown malware ThreatFox Abuse.ch 2025-01-13 06:57:39 2025-01-15 06:20:30
RustyStealer MalwareBazaar Abuse.ch 2025-01-12 17:46:00 2025-01-12 17:46:00 malicious-activity

Tags

unknown evasive onion execution defense_evasion discovery

Sample information

Filenames
5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd.exe, 5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd
File type
application/x-dosexec
Size
5482496 bytes
MD5
834c7fd865eee5f7e17a3a1fb62e7051
SHA-1
0246696395c8514494435f645cdff034d70d0951
SHA-256
5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd
First indexed
2025-01-12 19:25:07
Last updated
2026-08-27 10:13:37

Antivirus detections

EngineDetection
ALYacTrojan.GenericKD.75301847
AVGWin64:CrypterX-gen [Trj]
AlibabaTrojan:Win64/DelShad.5d395361
Antiy-AVLTrojan/Win32.Sonbokli
ArcabitTrojan.Generic.D47D03D7
AvastWin64:CrypterX-gen [Trj]
AviraTR/AVI.Agent.thksu
BitDefenderTrojan.GenericKD.75301847
BkavW32.Common.29D84B2B
CAT-QuickHealRansom.Funksec.S34839865
CTXexe.trojan.funksec
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DeepInstinctMALICIOUS
DrWebTrojan.Siggen30.46525
ESET-NOD32a variant of Win64/Filecoder.RN
Elasticmalicious (high confidence)
EmsisoftTrojan.GenericKD.75301847 (B)
F-SecureTrojan.TR/AVI.Agent.thksu
FireEyeTrojan.GenericKD.75301847
FortinetW32/PossibleThreat
GDataTrojan.GenericKD.75301847
GoogleDetected
IkarusTrojan.Win64.Krypt
K7AntiVirusTrojan ( 005bf3b01 )
K7GWTrojan ( 005bf3b01 )
KasperskyTrojan.Win32.DelShad.myi
KingsoftWin32.Trojan.DelShad.myi
LionicTrojan.Win32.FunkSec.4!c
MalwarebytesTrojan.Crypt.Generic
MaxSecureTrojan.Malware.318124991.susgen
McAfeeFunkLocker-HVH!834C7FD865EE
McAfeeDti!5226EA8E0F51
MicroWorld-eScanTrojan.GenericKD.75301847
MicrosoftRansom:Win64/FunkSec.CCJT!MTB
Paloaltogeneric.ml
PandaTrj/RansomGen.A
RisingRansom.LockFile!8.12D75 (CLOUD)
SkyhighBehavesLike.Win64.Rootkit.th
SophosTroj/FunkSec-A
SymantecRansom.Funk
TencentMalware.Win32.Gencirc.10c091e2
TrendMicroRansom.Win64.FUNKSEC.THAOFBE
TrendMicro-HouseCallRansom.Win64.FUNKSEC.THAOFBE
VIPRETrojan.GenericKD.75301847
VaristW64/Ransom.SB.gen!Eldorado
VirITTrojan.Win64.Genus.HOL
alibabacloudTrojan:Win/DelShad.mgR
huorongRansom/LockFile.au
AlibabaTrojan:Win64/DelShad.9a45c1a8
CTXexe.trojan.delshad
NANO-AntivirusTrojan.Win64.DelShad.kuwarl

Network contacts

199.232.192.193 199.232.196.193

DNS requests

i.imgur.com

Process list

NameCommand line
5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd.exefunksec
net.exe"net" session
net1.exe%WINDIR%\system32\net1 session
tasklist.exe"tasklist" /fi "IMAGENAME eq vmware"
powershell.exe"powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
powershell.exe"powershell" -Command "wevtutil sl Security /e:false"
wevtutil.exesl Security /e:false
powershell.exe"powershell" -Command "wevtutil sl Application /e:false"
wevtutil.exesl Application /e:false
powershell.exe"powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"
5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd.exe
net.exe"net" session
net1.exe%WINDIR%\system32\net1 session
tasklist.exe"tasklist" /fi "IMAGENAME eq vmware"
powershell.exe"powershell" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
powershell.exe"powershell" -Command "wevtutil sl Security /e:false"
powershell.exe"powershell" -Command "wevtutil sl Application /e:false"
wevtutil.exesl Application /e:false
powershell.exe"powershell" -Command "Set-ExecutionPolicy Bypass -Scope Process -Force"