540af6e934c1568893a2341f6604fb3b8905f7f02bb201bb01adfcf7ec43c146.exe

Classification: Malicious

540af6e934c1568893a2341f6604fb3b8905f7f02bb201bb01adfcf7ec43c146.exe is a malicious file sample. Reported by 2 threat sources, last seen 2026-09-02.

Detection summary

  • 42 antivirus detections (70% detection ratio)
  • 1 IDS alerts
  • 7 processes observed
  • 1 contacted hosts
  • 0 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2023-09-16 22:15:06 2026-09-02 12:45:06 malicious-activity
Generic.Malware MalwareBazaar Abuse.ch 2023-08-29 19:45:51 2023-08-29 19:45:51 malicious-activity

Tags

evasive netwire rat

Sample information

Filenames
540af6e934c1568893a2341f6604fb3b8905f7f02bb201bb01adfcf7ec43c146.exe, f8220108b1cfbe52828fb65d7b363895.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows, ...
Size
6821139 bytes
MD5
f8220108b1cfbe52828fb65d7b363895
SHA-1
e72953df0b83137c87e7b5f8c1fdad7b3a296e3a
SHA-256
540af6e934c1568893a2341f6604fb3b8905f7f02bb201bb01adfcf7ec43c146
First indexed
2023-08-29 20:17:49
Last updated
2026-09-02 12:45:06

Antivirus detections

EngineDetection
BkavW32.AIDetectMalware
LionicTrojan.Win32.Xegumumune.4!c
AVGWin32:SpywareX-gen [Trj]
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.68273853
FireEyeGeneric.mg.f8220108b1cfbe52
McAfeeArtemis!F8220108B1CF
Cylanceunsafe
SangforSpyware.Win32.Agent.Vzgc
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojan:Win32/Xegumumune.4b93ff0e
K7GWTrojan ( 0059b42a1 )
K7AntiVirusTrojan ( 0059b42a1 )
CyrenW32/ABRisk.IEWF-1647
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Packed.Themida.CL suspicious
CynetMalicious (score: 100)
APEXMalicious
KasperskyTrojan-Spy.Win32.Xegumumune.ocn
BitDefenderTrojan.GenericKD.68273853
AvastWin32:SpywareX-gen [Trj]
TencentWin32.Trojan-Spy.Xegumumune.Uwhl
EmsisoftTrojan.GenericKD.68273853 (B)
F-SecureTrojan.TR/Crypt.XPACK.Gen
VIPRETrojan.GenericKD.68273853
McAfee-GW-EditionBehavesLike.Win32.Generic.vc
SophosMal/Generic-S
GDataTrojan.GenericKD.68273853
AviraTR/Crypt.XPACK.Gen
MAXmalware (ai score=83)
ArcabitTrojan.Generic.D411C6BD
ViRobotTrojan.Win.Z.Agent.6821139
ZoneAlarmTrojan-Spy.Win32.Xegumumune.ocn
MicrosoftProgram:Win32/Wacapew.C!ml
GoogleDetected
AhnLab-V3Trojan/Win.Crypt.C5445060
ALYacTrojan.GenericKD.68273853
MalwarebytesMalware.Heuristic.1003
PandaTrj/Chgt.AD
Rising[email protected] (RDML:kF2Ge6HQ/jFHFU49gdP9Lw)
FortinetRiskware/Application
DeepInstinctMALICIOUS

Network contacts

185.12.14.32

Process list

NameCommand line
540af6e934c1568893a2341f6604fb3b8905f7f02bb201bb01adfcf7ec43c146.exe
sethc.exe
AcroRd32.exe"%TEMP%\document.pdf"
RdrCEF.exe--backgroundcolor=16448250
RdrCEF.exe--type=renderer --primordial-pipe-token=6143F5D9CA6123078DCDEDBA660F3FF8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=6143F5D9CA6123078DCDEDBA660F3FF8 --renderer-client-id=2 --mojo-platform-channel-handle=1280 --allow-no-sandbox-job /prefetch:1
RdrCEF.exe--type=renderer --primordial-pipe-token=53DA95E57D568E364BD102414D3F70BB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=53DA95E57D568E364BD102414D3F70BB --renderer-client-id=3 --mojo-platform-channel-handle=1352 --allow-no-sandbox-job /prefetch:1
sethc.exe