65a112982cc0d4e56c078c5333ed3553905bf4f3a639f2ff6e056ab518b6290e
Classification: Malicious
65a112982cc0d4e56c078c5333ed3553905bf4f3a639f2ff6e056ab518b6290e is a trojan (application/x-dosexec). Detected by 76 antivirus engines.
Detection summary
- 76 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: SERVHELPER (S0382)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| ServHelper | Abuse.ch | 2021-10-01 08:50:39 | 2021-10-01 08:50:39 | malicious-activity | S0382 ServHelper |
Sample information
- Filenames
- c1e0df4f2321e9375baee3a0a26fba64
- File type
- application/x-dosexec
- MD5
c1e0df4f2321e9375baee3a0a26fba64- SHA-1
dcf4d90d2f3fd11f14b5413be5b7dde70ff33f7c- SHA-256
65a112982cc0d4e56c078c5333ed3553905bf4f3a639f2ff6e056ab518b6290e- First indexed
- 2021-10-01 10:15:09
- Last updated
- 2026-08-24 00:35:48
Antivirus detections
| Engine | Detection |
|---|---|
| Lionic | Trojan.Win32.Cobalt.trRF |
| Elastic | malicious (high confidence) |
| DrWeb | PowerShell.Inject.56 |
| MicroWorld-eScan | Trojan.GenericKD.37683449 |
| Malwarebytes | Malware.AI.4021206680 |
| Sangfor | Trojan.Win32.Save.a |
| CrowdStrike | win/malicious_confidence_90% (D) |
| Symantec | Trojan.Gen.MBT |
| ESET-NOD32 | a variant of WinGo/GoCLR.B |
| APEX | Malicious |
| ClamAV | Win.Malware.Bulz-9847817-0 |
| Kaspersky | Trojan-Dropper.MSIL.Agent.seskpw |
| BitDefender | Trojan.GenericKD.37683449 |
| Avast | Win64:Trojan-gen |
| Ad-Aware | Trojan.GenericKD.37683449 |
| Emsisoft | Trojan.Agent (A) |
| McAfee-GW-Edition | BehavesLike.Win64.Generic.th |
| FireEye | Trojan.GenericKD.37683449 |
| Sophos | Mal/Generic-S |
| Ikarus | Trojan.WinGo.Goclr |
| Jiangmin | Trojan.Generic.gzxxe |
| MAX | malware (ai score=87) |
| Microsoft | Trojan:Script/Phonzy.B!ml |
| ZoneAlarm | Trojan-Dropper.MSIL.Agent.seskpw |
| GData | Trojan.GenericKD.37683449 |
| Cynet | Malicious (score: 100) |
| AhnLab-V3 | Trojan/Win.Agent.R442164 |
| McAfee | Artemis!C1E0DF4F2321 |
| Cylance | Unsafe |
| TrendMicro-HouseCall | TROJ_GEN.R002H0DIT21 |
| Rising | HackTool.GoCLR!1.D71D (CLASSIC) |
| SentinelOne | Static AI - Suspicious PE |
| eGambit | Unsafe.AI_Score_100% |
| Fortinet | W64/GoCLR.B!tr |
| AVG | Win64:Trojan-gen |
| ALYac | Trojan.GenericKDZ.78238 |
| AVG | Win64:TrojanX-gen [Trj] |
| Alibaba | TrojanDropper:MSIL/GoCLR.a32d635b |
| Antiy-AVL | Trojan[Dropper]/MSIL.Agent |
| Arcabit | Trojan.Generic.D1319E |
| Avast | Win64:TrojanX-gen [Trj] |
| Avira | HEUR/AGEN.1318179 |
| BitDefender | Trojan.GenericKDZ.78238 |
| Bkav | W64.AIDetectMalware |
| CAT-QuickHeal | Trojan.Ghanarava.16962888216fba64 |
| CTX | exe.trojan.goclr |
| CrowdStrike | win/malicious_confidence_100% (W) |
| DeepInstinct | MALICIOUS |
| F-Secure | Heuristic.HEUR/AGEN.1318179 |
| FireEye | Trojan.GenericKDZ.78238 |
| GData | Win64.Trojan.GoCLR.A |
| Detected | |
| Gridinsoft | Trojan.Win64.Agent.oa!s1 |
| Ikarus | Trojan.WinGo.Rozena |
| K7AntiVirus | Trojan ( 00580c871 ) |
| K7GW | Trojan ( 00580c871 ) |
| Lionic | Trojan.MSIL.Agent.b!c |
| Malwarebytes | Malware.AI.328584946 |
| MaxSecure | Trojan.Malware.124025665.susgen |
| McAfee | GenericRXAA-AA!C1E0DF4F2321 |
| McAfeeD | ti!65A112982CC0 |
| MicroWorld-eScan | Trojan.GenericKDZ.78238 |
| Microsoft | Trojan:Win64/Cobalt.DF!MTB |
| Paloalto | generic.ml |
| Panda | Trj/CI.A |
| Skyhigh | BehavesLike.Win64.Kryptik.th |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Msil.Trojan-Dropper.Agent.Rgil |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04C9V |
| VBA32 | TrojanDropper.MSIL.Agent |
| VIPRE | Trojan.GenericKDZ.78238 |
| Xcitium | Malware@#p82uecyhw33h |
| Yandex | Trojan.DR.Agent!dAxRSqjzHn0 |
| Zillya | Dropper.Agent.Win32.464564 |
| alibabacloud | Trojan[dropper]:Multi/GoCLR.B |
| huorong | TrojanDropper/W64.Agent.t |