83001fcaf0b0224ef118d879eb488ed5512922ea07806b7f3e26db3ab1ff563d

Classification: Malicious

83001fcaf0b0224ef118d879eb488ed5512922ea07806b7f3e26db3ab1ff563d is a malicious file sample. Reported by 1 threat source, last seen 2026-09-02.

Detection summary

  • 56 antivirus detections
  • 2 IDS alerts
  • 13 processes observed
  • 2 contacted hosts
  • 2 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2025-04-20 11:00:06 2026-09-02 19:45:06 malicious-activity

Tags

evasive ransomware windows-server-utility infostealer

Sample information

Filenames
83001fcaf0b0224ef118d879eb488ed5512922ea07806b7f3e26db3ab1ff563d, 83001fcaf0b0224ef118d879eb488ed5512922ea07806b7f3e26db3ab1ff563d.exe
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
796672 bytes
MD5
79dc0ae92c02abf8e51b5786d83d4de2
SHA-1
ddbea79f49f5c736c532ede7406329b09814bd4d
SHA-256
83001fcaf0b0224ef118d879eb488ed5512922ea07806b7f3e26db3ab1ff563d
First indexed
2025-04-20 10:51:01
Last updated
2026-09-02 19:45:06

Antivirus detections

EngineDetection
ALYacGen:Variant.Ransom.Loki.19527
APEXMalicious
AVGWin32:PWSX-gen [Trj]
AhnLab-V3Trojan/Win.AgentTesla.C5534413
AlibabaTrojanPSW:MSIL/AgentTesla.ec38fc69
ArcabitTrojan.Ransom.Loki.D4C47
AvastWin32:PWSX-gen [Trj]
AviraHEUR/AGEN.1374496
BitDefenderGen:Variant.Ransom.Loki.19527
CAT-QuickHealTrojan.Ghanarava.17328104943d4de2
CTXexe.trojan.msil
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DeepInstinctMALICIOUS
DrWebTrojan.Inject4.59820
ESET-NOD32a variant of MSIL/Kryptik.AJOF
Elasticmalicious (high confidence)
EmsisoftGen:Variant.Ransom.Loki.19527 (B)
F-SecureHeuristic.HEUR/AGEN.1374496
FireEyeGeneric.mg.79dc0ae92c02abf8
FortinetMSIL/Kryptik.AJOF!tr
GDataGen:Variant.Ransom.Loki.19527
GoogleDetected
IkarusTrojan.MSIL.Crypt
JiangminBackdoor.MSIL.fxxg
K7AntiVirusRiskware ( 00584baa1 )
K7GWRiskware ( 00584baa1 )
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.gen
KingsoftWin32.PSWTroj.Undef.a
LionicTrojan.Win32.Agensla.i!c
MaxSecureTrojan.Malware.74499699.susgen
McAfeeArtemis!79DC0AE92C02
McAfeeDti!83001FCAF0B0
MicroWorld-eScanGen:Variant.Ransom.Loki.19527
MicrosoftTrojan:MSIL/AgentTesla.RCK!MTB
NANO-AntivirusTrojan.Win32.Agensla.kcyqzu
Paloaltogeneric.ml
PandaTrj/GdSda.A
RisingMalware.Obfus/[email protected] (RDM.MSIL2:EuhT7vVpLuI2DPUog+etuQ)
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.bc
SophosMal/Generic-S
SymantecScr.Malcode!gdn34
TencentMalware.Win32.Gencirc.13f4051a
Trapminemalicious.moderate.ml.score
TrendMicro-HouseCallTrojan.Win32.VSX.PE04C9V
VBA32CIL.HeapOverride.Heur
VIPREGen:Variant.Ransom.Loki.19527
VaristW32/MSIL_Kryptik.KAS.gen!Eldorado
ViRobotTrojan.Win.Z.Kryptik.796672.F
VirITTrojan.Win32.MSIL_Heur.A
YandexTrojan.Kryptik!u0gufXg+rBY
ZillyaTrojan.Kryptik.Win32.4354716
alibabacloudTrojan[stealer]:MSIL/AgentTesla.RWJ2XJC
huorongHEUR:TrojanSpy/MSIL.AgentTesla.sl

Network contacts

172.67.74.152 104.26.13.205

DNS requests

api.ipify.org mymobileorder.com

Process list

NameCommand line
83001fcaf0b0224ef118d879eb488ed5512922ea07806b7f3e26db3ab1ff563d.exe
83001fcaf0b0224ef118d879eb488ed5512922ea07806b7f3e26db3ab1ff563d.exe
WerFault.exe-u -p 4880 -s 1232
WerFault.exe-u -p 4880 -s 1232
WerFault.exe-u -p 4880 -s 1204
WerFault.exe-pss -s 440 -p 4880 -ip 4880
WerFault.exe-pss -s 500 -p 4880 -ip 4880
YseEYgM.exe
YseEYgM.exe
WerFault.exe-u -p 7696 -s 1268
WerFault.exe-u -p 7696 -s 1268
WerFault.exe-u -p 7696 -s 1268
WerFault.exe-pss -s 448 -p 7696 -ip 7696