20230118_67c911510e257b34.exe_

Classification: Malicious

20230118_67c911510e257b34.exe_ is a malicious file sample. Linked to Ke3Chang, Backdoordiplomacy activity. Reported by 3 threat sources, last seen 2025-11-16.

Detection summary

  • 70 antivirus detections (83% detection ratio)
  • 0 IDS alerts
  • 1 processes observed
  • 0 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Intrusion sets: KE3CHANG (G0004) BACKDOORDIPLOMACY (G0135)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Cyber Threat Alliance 2025-11-16 10:23:25 2025-11-16 10:23:25
Generic Malware Hybrid-Analysis 2023-06-29 08:00:03 2023-06-29 08:00:03
Mirage Maltiverse 2023-01-20 04:14:49 2023-01-21 18:46:08 malicious-activity G0004 Ke3chang
Backdoordiplomacy Maltiverse 2023-01-20 04:14:49 2023-01-21 18:46:06 malicious-activity G0135 BackdoorDiplomacy

Tags

adware backdoor evasive gozi hacktool infostealer isfb metasploit meterpreter nsis papras qakbot ursnif apt

Sample information

Filenames
20230118_67c911510e257b34.exe_
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
572928 bytes
MD5
7b3f7c751a5c3b1823baac97ccb4d4c6
SHA-1
615b5a92b6066fc992dae0d5f6abf29fe53cf2f9
SHA-256
67c911510e257b341be77bc2a88cedc99ace2af852f7825d9710016619875e80
First indexed
2023-01-21 18:46:06
Last updated
2026-02-10 05:40:31

Antivirus detections

EngineDetection
ALYacBackdoor.Agent.Turian
APEXMalicious
AVGWin32:Evo-gen [Trj]
AhnLab-V3Malware/Win.RealProtect-LS.C5211415
AlibabaTrojan:Win32/VMProtBad.f9216b33
Antiy-AVLTrojan[APT]/Win32.APT15
ArcabitTrojan.Generic.D3D0C500
AvastWin32:Evo-gen [Trj]
AviraHEUR/AGEN.1361303
BitDefenderTrojan.GenericKD.64013568
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.Ghanarava.1670473605B4D4C6
CTXexe.trojan.generic
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
DrWebBackDoor.Siggen2.4364
ESET-NOD32a variant of Win32/BackdoorDiplomacy.A
Elasticmalicious (high confidence)
EmsisoftTrojan.GenericKD.64013568 (B)
F-SecureHeuristic.HEUR/AGEN.1361303
FireEyeGeneric.mg.7b3f7c751a5c3b18
FortinetW32/PossibleThreat
GDataWin32.Trojan.Kryptik.HK@susp
GoogleDetected
GridinsoftTrojan.Win32.Agent.oa!s5
IkarusTrojan.Win32.Agent
JiangminBackdoor.Turian.a
K7AntiVirusRiskware ( 0040eff71 )
K7GWRiskware ( 0040eff71 )
KasperskyTrojan.Win32.Agentb.lajm
Kingsoftwin32.troj.undef.a
LionicTrojan.Win32.Turian.4!c
MalwarebytesMalware.AI.4289338482
MaxSecureTrojan.Malware.196654697.susgen
McAfeeArtemis!7B3F7C751A5C
McAfeeDReal Protect-LS!7B3F7C751A5C
MicroWorld-eScanTrojan.GenericKD.64013568
MicrosoftTrojan:Win32/Malgent!MSR
NANO-AntivirusTrojan.Win32.Mlw.juifnc
Paloaltogeneric.ml
PandaTrj/CI.A
RisingMalware.Spring0410 (LIGHT:7B3F7C751A5C3B1823BAAC97CCB4D4C6)
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.hc
SophosTroj/APosT-AA
SymantecTrojan Horse
TencentMalware.Win32.Gencirc.13c135fc
Trapminemalicious.high.ml.score
TrendMicroTrojan.Win32.IRCBOT.VSNW1DA24
TrendMicro-HouseCallTrojan.Win32.IRCBOT.VSNW1DA24
VBA32TScope.Malware-Cryptor.SB
VIPRETrojan.GenericKD.64013568
VaristW32/ABRisk.JSGK-4230
XcitiumMalware@#2ul4uo16gytig
ZillyaTrojan.Agent.Win32.3168203
ZonerProbably Heur.ExeHeaderL
alibabacloudTrojan:Win/BackdoorDiplomacy.A
huorongTrojan/Generic!99E7955D45A4BF2A
ESET-NOD32Win32/BackdoorDiplomacy.A trojan
K7AntiVirusTrojan ( 005fc49d1 )
K7GWTrojan ( 005fc49d1 )
LionicTrojan.Win32.BackdoorDiplomacy.4!c
MalwarebytesMalware.AI.1427989116
RisingTrojan.BackdoorDiplomacy!8.1B23E (KTSE)
TrellixENSArtemis!7B3F7C751A5C
ViRobotTrojan.Win.Z.Agent.572928.F
ZoneAlarmTroj/APosT-AA

DNS requests

update.delldrivers.in

Process list

NameCommand line
20230118_67c911510e257b34.exe_.exe