7ef9bf4a87f6356565dc2bbac8ff10c8dbf6298e4ac7ad92367d9bd73d30d856

Classification: Malicious

7ef9bf4a87f6356565dc2bbac8ff10c8dbf6298e4ac7ad92367d9bd73d30d856 is a malicious file sample. Reported by 1 threat source, last seen 2026-09-02.

Detection summary

  • 27 antivirus detections
  • 0 IDS alerts
  • 18 processes observed
  • 2 contacted hosts
  • 7 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-11-21 03:26:49 2026-09-02 13:45:05 malicious-activity

Tags

windows-server-utility evasive

Sample information

Filenames
7ef9bf4a87f6356565dc2bbac8ff10c8dbf6298e4ac7ad92367d9bd73d30d856, file
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
922624 bytes
MD5
b54b3086cc1a4141a33a248d47be9d3d
SHA-1
86f6fe5ff1dd989b49fbf551b0ce61d053f0cb1d
SHA-256
7ef9bf4a87f6356565dc2bbac8ff10c8dbf6298e4ac7ad92367d9bd73d30d856
First indexed
2024-11-21 03:15:19
Last updated
2026-09-02 13:45:05

Antivirus detections

EngineDetection
APEXMalicious
BkavW32.AIDetectMalware
CrowdStrikewin/malicious_confidence_60% (W)
CylanceUnsafe
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
DrWebTrojan.Siggen29.54908
ESET-NOD32a variant of Win32/Autoit.ORL
Elasticmalicious (high confidence)
FireEyeGeneric.mg.b54b3086cc1a4141
FortinetAutoIt/Agent.ORL!tr
GoogleDetected
IkarusTrojan.Win32.Autoit
KasperskyHEUR:Trojan.Script.Generic
MalwarebytesTrojan.Downloader.AutoIt
McAfeeDReal Protect-LS!B54B3086CC1A
MicrosoftProgram:Win32/Wacapew.C!ml
RisingStealer.Browser/Autoit!1.10428 (CLASSIC)
SangforTrojan.Win32.Save.a
SkyhighBehavesLike.Win32.Injector.dh
SymantecScr.Malcode!gen
TencentUnk.Win32.Script.404787
Trapminesuspicious.low.ml.score
VBA32Trojan.Autoit.F
VaristW32/AutoIt.ACA.gen!Eldorado
VirITTrojan.Win32.AutoIt_Heur.K
huorongTrojan/AutoIT.Agent.f

Network contacts

142.251.219.170 34.107.221.82

DNS requests

detectportal.firefox.com mozilla.map.fastly.net prod.refractr.prod.webservices.mozgcp.net safebrowsing.googleapis.com shavar.prod.mozaws.net tracking-protection.prod.mozaws.net prod.detectportal.prod.cloudops.mozgcp.net

Process list

NameCommand line
file.exe
taskkill.exetaskkill /F /IM firefox.exe /T
taskkill.exetaskkill /F /IM chrome.exe /T
taskkill.exetaskkill /F /IM msedge.exe /T
taskkill.exetaskkill /F /IM opera.exe /T
taskkill.exetaskkill /F /IM brave.exe /T
firefox.exe--kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
firefox.exe-contentproc --channel="4172.0.387406567\1596621108" -greomni "%PROGRAMFILES%\Mozilla Firefox\omni.ja" -appomni "%PROGRAMFILES%\Mozilla Firefox\browser\omni.ja" -appdir "%PROGRAMFILES%\Mozilla Firefox\browser" "%LOCALAPPDATA%\ow\Mozilla\Temp-{f69c583e-e232-4622-8e1e-6cf80eb85c55}" 4172 "\\.\pipe\gecko-crash-server-pipe.4172" gpu
taskkill.exetaskkill /F /IM firefox.exe /T
taskkill.exetaskkill /F /IM chrome.exe /T
taskkill.exetaskkill /F /IM msedge.exe /T
taskkill.exetaskkill /F /IM opera.exe /T
taskkill.exetaskkill /F /IM brave.exe /T
firefox.exe--kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
firefox.exe-contentproc --channel="1972.0.605605577\100440756" -greomni "%PROGRAMFILES%\Mozilla Firefox\omni.ja" -appomni "%PROGRAMFILES%\Mozilla Firefox\browser\omni.ja" -appdir "%PROGRAMFILES%\Mozilla Firefox\browser" "%LOCALAPPDATA%\ow\Mozilla\Temp-{f69c583e-e232-4622-8e1e-6cf80eb85c55}" 1972 "\\.\pipe\gecko-crash-server-pipe.1972" gpu
firefox.exe-contentproc --channel="1972.3.720593718\840787757" -childID 1 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332;  ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵           ​‎‏‐’․‧

‪‫‬‭‮ ‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻　。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ�|159:4;high|194:38;{f69c583e-e232-4622-8e1e-6cf80eb85c55}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 1972 "\\.\pipe\gecko-crash-server-pipe.1972" tab
firefox.exe-contentproc --channel="1972.13.198820636\343610320" -greomni "%PROGRAMFILES%\Mozilla Firefox\omni.ja" -appomni "%PROGRAMFILES%\Mozilla Firefox\browser\omni.ja" -appdir "%PROGRAMFILES%\Mozilla Firefox\browser" "%LOCALAPPDATA%\ow\Mozilla\Temp-{f69c583e-e232-4622-8e1e-6cf80eb85c55}" 1972 "\\.\pipe\gecko-crash-server-pipe.1972" gpu
taskkill.exetaskkill /F /IM firefox.exe /T