650f8f70149f12df57e7f82a6ae2967ac198588ae0c0ac8291925337a3cc544a

Classification: Malicious

650f8f70149f12df57e7f82a6ae2967ac198588ae0c0ac8291925337a3cc544a is a trojan (Windows executable, 2.6 MB). Linked to Bitter activity.

Detection summary

  • 75 antivirus detections (69% detection ratio)
  • 0 IDS alerts
  • 5 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: BITTER (G1002)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Hazy Tiger Maltiverse 2023-01-20 04:13:01 2023-01-21 18:46:11 malicious-activity G1002 Bitter
Generic Malware Hybrid-Analysis 2023-01-18 12:00:51 2023-01-18 12:00:51

Tags

apt hazy tiger

Sample information

Filenames
650f8f70149f12df57e7f82a6ae2967ac198588ae0c0ac8291925337a3cc544a.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
2767360 bytes
MD5
9ea108e031d29ee21b3f81e503eca87d
SHA-1
18efaefa801c24ca978fbbd22cf2645af5aeac1d
SHA-256
650f8f70149f12df57e7f82a6ae2967ac198588ae0c0ac8291925337a3cc544a
First indexed
2023-01-18 11:47:03
Last updated
2025-10-10 01:20:57

Antivirus detections

EngineDetection
LionicTrojan.Win32.Stealer.12!c
MicroWorld-eScanGen:Variant.Zusy.440480
ClamAVWin.Trojan.Emotet-9955184-0
FireEyeGen:Variant.Zusy.440480
McAfeeArtemis!9EA108E031D2
MalwarebytesMalware.AI.2524530983
VIPREGen:Variant.Zusy.440480
K7AntiVirusTrojan ( 00599e471 )
AlibabaTrojanSpy:Win32/AveMaria.974574f8
K7GWTrojan ( 00599e471 )
VirITTrojan.Win32.Genus.LZM
CyrenW32/ABRisk.EBGD-8678
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Kryptik.HQIW
ZonerTrojan.Win32.149794
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan-Spy.Win32.Stealer.gen
BitDefenderGen:Variant.Zusy.440480
NANO-AntivirusTrojan.Win32.Stealer.jtftao
AvastWin32:Trojan-gen
TencentMalware.Win32.Gencirc.10bd9ca4
SophosMal/Generic-S
DrWebTrojan.Inject4.45875
ZillyaTrojan.Kryptik.Win32.3940636
TrendMicroTROJ_GEN.R002C0DK322
McAfee-GW-EditionArtemis!Trojan
EmsisoftGen:Variant.Zusy.440480 (B)
GDataGen:Variant.Zusy.440480
JiangminTrojanSpy.Stealer.aehn
AviraTR/AD.MortyStealer.lvmqh
MAXmalware (ai score=87)
Antiy-AVLTrojan/Win32.Kryptik
ArcabitTrojan.Zusy.D6B8A0
MicrosoftTrojan:Win32/AveMaria.NEBV!MTB
GoogleDetected
AhnLab-V3Trojan/Win.Generic.C5287083
ALYacGen:Variant.Zusy.440480
VBA32TrojanSpy.AveMaria
TrendMicro-HouseCallTROJ_GEN.R002C0DK322
RisingStealer.Agent!8.C2 (TFE:5:pRLkw6UN3EG)
YandexTrojan.Kryptik!rHEBZiC0AYE
IkarusTrojan.Win32.Crypt
FortinetW32/Kryptik.HQIW!tr
AVGWin32:Trojan-gen
PandaTrj/Chgt.AA
CrowdStrikewin/malicious_confidence_100% (W)
ALYacTrojan.PSW.AveMaria
AlibabaTrojanSpy:Win32/AveMaria.d61584db
Antiy-AVLTrojan/Win32.Kasablanka
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.Ghanarava.1732959341eca87d
CTXexe.trojan.avemaria
CylanceUnsafe
CynetMalicious (score: 99)
DeepInstinctMALICIOUS
F-SecureTrojan.TR/AD.MortyStealer.lvmqh
GridinsoftTrojan.Win32.Kryptik.oa!s1
KingsoftWin32.Trojan-Spy.Stealer.gen
LionicTrojan.Win32.AveMaria.l!c
MalwarebytesCrypt.Trojan.MSIL.DDS
MaxSecureTrojan.Malware.73793603.susgen
McAfeeDti!650F8F70149F
MicrosoftTrojan:Win32/AveMaria!rfn
Paloaltogeneric.ml
SkyhighArtemis!Trojan
SymantecTrojan Horse
TrellixENSGenericRXAA-AA!9EA108E031D2
TrendMicroTrojan.Win32.AVEMARIA.VSNW1DA24
TrendMicro-HouseCallTrojan.Win32.AVEMARIA.VSNW1DA24
VaristW32/ABTrojan.EBGD-8678
ViRobotTrojan.Win.Z.Zusy.2767360
WebrootW32.Trojan.Emotet
alibabacloudTrojan[spy]:Win/AveMaria.NAHT3DGW
huorongTrojanSpy/Stealer.dn

Network contacts

89.22.232.145

Process list

NameCommand line
650f8f70149f12df57e7f82a6ae2967ac198588ae0c0ac8291925337a3cc544a.exe
powershell.exepowershell Add-MpPreference -ExclusionPath C:\
cmd.exe/c ""%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat" "
WMIC.exewmic process call create '"%USERPROFILE%\Documents\Documents:ApplicationData"'
DocumentsApplicationData