9b75e3e28f95345937f507b281e2a32a.exe

Classification: Malicious

9b75e3e28f95345937f507b281e2a32a.exe is a malicious file sample. Linked to Crimson malware. Reported by 2 threat sources, last seen 2023-02-23.

Detection summary

  • 41 antivirus detections (59% detection ratio)
  • 0 IDS alerts
  • 1 processes observed
  • 1 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Malware families: CRIMSON (S0115)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2023-02-23 21:30:03 2023-02-23 21:30:03
CrimsonRAT MalwareBazaar Abuse.ch 2023-02-23 20:40:24 2023-02-23 20:40:24 malicious-activity S0115 Crimson

Sample information

Filenames
9b75e3e28f95345937f507b281e2a32a.exe, 718137900e59dd9dd9f3582bfb6841d27955484b47290b94ec5316317e623aec.exe
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
10139136 bytes
MD5
9b75e3e28f95345937f507b281e2a32a
SHA-1
36909a5b5a0c8355eaa649af2f9136a7689d1cd9
SHA-256
718137900e59dd9dd9f3582bfb6841d27955484b47290b94ec5316317e623aec
First indexed
2023-02-23 21:09:53
Last updated
2023-02-23 21:30:05

Antivirus detections

EngineDetection
LionicTrojan.Win32.Heracles.4!c
DrWebBackDoor.SpyBotNET.47
MicroWorld-eScanGen:Variant.MSILHeracles.36946
FireEyeGeneric.mg.9b75e3e28f953459
ALYacGen:Variant.MSILHeracles.36946
MalwarebytesMalware.AI.414915772
ZillyaTrojan.Agent.Win32.3235315
SangforVirus.Win32.Save.a
AlibabaTrojan:MSIL/Generic.01f81cf8
CrowdStrikewin/malicious_confidence_100% (W)
BitDefenderThetaGen:NN.ZemsilF.36276.@p0@ams@Wbl
CyrenW32/ABRisk.VLIY-5123
SymantecML.Attribute.HighConfidence
Elasticmalicious (high confidence)
ESET-NOD32a variant of MSIL/Agent.BNY
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 99)
KasperskyHEUR:Trojan-Ransom.MSIL.Foreign.gen
BitDefenderGen:Variant.MSILHeracles.36946
AvastWin32:TrojanX-gen [Trj]
TencentMsil.Trojan-Ransom.Foreign.Jqil
EmsisoftGen:Variant.MSILHeracles.36946 (B)
VIPREGen:Variant.MSILHeracles.36946
McAfee-GW-EditionArtemis
IkarusTrojan.MSIL.Agent
AviraHEUR/AGEN.1236422
Antiy-AVLTrojan[Ransom]/MSIL.Foreign
MicrosoftTrojan:Win32/Wacatac.B!ml
GridinsoftRansom.Win32.Wacatac.sa
ArcabitTrojan.MSILHeracles.D9052
GDataGen:Variant.MSILHeracles.36946
GoogleDetected
McAfeeArtemis!9B75E3E28F95
MAXmalware (ai score=83)
RisingRansom.Foreign!8.292 (CLOUD)
SentinelOneStatic AI - Malicious PE
FortinetMSIL/Agent.BNY!tr
AVGWin32:TrojanX-gen [Trj]
Cybereasonmalicious.b5a0c8
PandaTrj/Chgt.AC

Network contacts

62.171.130.47

DNS requests

katrinakaif.ddns.net

Process list

NameCommand line
718137900e59dd9dd9f3582bfb6841d27955484b47290b94ec5316317e623aec.exe