81e0f965f92b1b5ab9e12f818e2751bde8b8119f6a83fa84035434f38920c91c
Classification: Malicious
81e0f965f92b1b5ab9e12f818e2751bde8b8119f6a83fa84035434f38920c91c is a malicious file sample. Reported by 2 threat sources, last seen 2026-09-02.
Detection summary
- 57 antivirus detections (81% detection ratio)
- 3 IDS alerts
- 20 processes observed
- 3 contacted hosts
- 3 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Hybrid-Analysis |
2024-01-08 13:45:04 |
2026-09-02 17:45:04 |
malicious-activity
|
|
| RiseProStealer |
MalwareBazaar Abuse.ch |
2024-01-02 19:28:06 |
2024-01-02 19:28:06 |
malicious-activity
|
|
Sample information
- Filenames
- 81e0f965f92b1b5ab9e12f818e2751bde8b8119f6a83fa84035434f38920c91c, rest.exe, file
- File type
- application/x-dosexec
- Size
- 1526272 bytes
- MD5
9f06693538587d7eb9af17a8db09c402- SHA-1
391ebd258f1ce59e588e94a6da2e5ba994d707e4- SHA-256
81e0f965f92b1b5ab9e12f818e2751bde8b8119f6a83fa84035434f38920c91c- First indexed
- 2024-01-02 20:18:59
- Last updated
- 2026-09-02 17:45:04
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Trojan.GenericKD.71029220 |
| APEX | Malicious |
| AVG | Win32:TrojanX-gen [Trj] |
| AhnLab-V3 | Trojan/Win.Generic.R629352 |
| Alibaba | Packed:Win32/EnigmaProtector.7045036d |
| Antiy-AVL | Trojan/Win32.Wacatac |
| Arcabit | Trojan.Generic.D43BD1E4 |
| Avast | Win32:TrojanX-gen [Trj] |
| Avira | HEUR/AGEN.1306479 |
| BitDefender | Trojan.GenericKD.71029220 |
| BitDefenderTheta | Gen:NN.ZexaF.36608.Dz0@aq9c!Rm |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Trojanpws.Risepro |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.58f1ce |
| Cylance | unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.PWS.Stealer.38262 |
| ESET-NOD32 | a variant of Win32/Packed.EnigmaProtector.M suspicious |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.GenericKD.71029220 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1306479 |
| FireEye | Generic.mg.9f06693538587d7e |
| Fortinet | PossibleThreat.MTG.H |
| GData | Win32.Trojan.PSE.1L0J4MO |
| Google | Detected |
| Gridinsoft | Ransom.Win32.Bladabindi.sa |
| Ikarus | Trojan.Dropper.Agent |
| K7AntiVirus | Trojan ( 0052ab361 ) |
| K7GW | Trojan ( 0052ab361 ) |
| Kaspersky | Trojan-PSW.Win32.RisePro.nz |
| Kingsoft | Win32.Troj.Unknown.a |
| Lionic | Trojan.Win32.RisePro.i!c |
| MAX | malware (ai score=80) |
| Malwarebytes | Spyware.PasswordStealer |
| MaxSecure | Trojan.Malware.221954550.susgen |
| McAfee | Artemis!9F0669353858 |
| MicroWorld-eScan | Trojan.GenericKD.71029220 |
| Microsoft | Trojan:MSIL/RiseProStealer.AAOF!MTB |
| Panda | Trj/RnkBend.A |
| Rising | Stealer.RisePro!8.176E1 (CLOUD) |
| Sangfor | Suspicious.Win32.Save.ins |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Generic.tc |
| Sophos | Mal/Generic-S |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.13fb05a2 |
| Trapmine | malicious.high.ml.score |
| TrendMicro | Trojan.Win32.PRIVATELOADER.YXDLZZ |
| TrendMicro-HouseCall | Trojan.Win32.PRIVATELOADER.YXDLZZ |
| VBA32 | Trojan.Wacatac |
| VIPRE | Trojan.GenericKD.71029220 |
| ViRobot | Trojan.Win.Z.Agent.1526272 |
| ZoneAlarm | Trojan-PSW.Win32.RisePro.nz |
| Zoner | Probably Heur.ExeHeaderL |
| tehtris | Generic.Malware |
Process list
| Name | Command line |
|---|
| 81e0f965f92b1b5ab9e12f818e2751bde8b8119f6a83fa84035434f38920c91c.exe | |
| cmd.exe | /c schtasks /create /f /RU "S2S3wMu" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST |
| schtasks.exe | schtasks /create /f /RU "S2S3wMu" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST |
| cmd.exe | /c schtasks /create /f /RU "S2S3wMu" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST |
| schtasks.exe | schtasks /create /f /RU "S2S3wMu" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST |
| rest.exe | |
| cmd.exe | /c schtasks /create /f /RU "FR5JHDn" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST |
| schtasks.exe | schtasks /create /f /RU "FR5JHDn" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST |
| cmd.exe | /c schtasks /create /f /RU "FR5JHDn" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST |
| schtasks.exe | schtasks /create /f /RU "FR5JHDn" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST |
| rest.exe | |
| cmd.exe | /c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST |
| schtasks.exe | schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST |
| cmd.exe | /c schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST |
| schtasks.exe | schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST |
| OfficeTrackerNMP131.exe | |
| OfficeTrackerNMP131.exe | |
| OfficeTrackerNMP131.exe | |
| FANBooster131.exe | |
| OfficeTrackerNMP131.exe | |