z1PONo_023578.bat
Classification: Malicious
z1PONo_023578.bat is a trojan (Windows executable). Detected by 35 antivirus engines. Linked to Darktortilla malware. 10 sightings, last seen 2026-05-05.
Detection summary
- 35 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: DARKTORTILLA (S1066)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Xworm | Triage | 2026-05-05 05:03:01 | 2026-05-05 08:08:33 | malicious-activity | |
| Generic Malware | Hybrid-Analysis | 2026-05-05 05:45:04 | 2026-05-05 06:45:04 | ||
| DarkTortilla | MalwareBazaar Abuse.ch | 2026-05-05 05:00:08 | 2026-05-05 05:00:08 | malicious-activity | S1066 DarkTortilla |
Tags
xworm discovery rat trojan collection spyware stealerSample information
- Filenames
- z1PONo_023578.bat, PO No. 023PNG .exe, 81e61ac4acdcda1d827ef3d9b3f527e40e8403766fc047228203446c55eb7cbc.bin, _81e61ac4acdcda1d827ef3d9b3f527e40e8403766fc047228203446c55eb7cbc.exe
- File type
- PE32 executable for MS Windows 4.00 (GUI), Intel i ...
- MD5
4b61feac9d02da6985d4eb45d8a9a232- SHA-1
733adceea3d57fb4ee709bb8359177498fcc9716- SHA-256
81e61ac4acdcda1d827ef3d9b3f527e40e8403766fc047228203446c55eb7cbc- First indexed
- 2026-05-05 05:00:08
- Last updated
- 2026-10-04 11:37:48
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | IL:Trojan.MSILZilla.165433 |
| APEX | Malicious |
| AVG | MalwareX-gen [Pws] |
| AhnLab-V3 | Trojan/Win.Formbook.X2183 |
| Arcabit | IL:Trojan.MSILZilla.D28639 |
| Avast | MalwareX-gen [Pws] |
| BitDefender | IL:Trojan.MSILZilla.165433 |
| Bkav | W32.AIDetectMalware.CS |
| CTX | exe.trojan.msilzilla |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| ESET-NOD32 | MSIL/Kryptik.AQCQ trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | IL:Trojan.MSILZilla.165433 (B) |
| Fortinet | MSIL/Kryptik.APXS!tr |
| GData | IL:Trojan.MSILZilla.165433 |
| Detected | |
| Ikarus | Trojan.MSIL.Crypt |
| Kaspersky | HEUR:Backdoor.MSIL.Androm.gen |
| Malwarebytes | MachineLearning/Anomalous.100% |
| McAfeeD | Trojan:Win/Vidar.TB |
| MicroWorld-eScan | IL:Trojan.MSILZilla.165433 |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| Paloalto | generic.ml |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:X84LacZ4AvcI6F/zxAfnxA) |
| SentinelOne | Static AI - Malicious PE |
| Sophos | Mal/Generic-S |
| Symantec | ML.Attribute.HighConfidence |
| Trapmine | malicious.moderate.ml.score |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04C9z |
| VIPRE | IL:Trojan.MSILZilla.165433 |
| Varist | W32/MSIL_Agent.KBL.gen!Eldorado |
| VirIT | Trojan.Win32.MSIL_Heur.A |
| huorong | Trojan/MSIL.Injector.nj |