84545b2db5b60b257083f5ebbc77abbc847724293c378ddf87b1ec58b4d6aaee
Classification: Malicious
84545b2db5b60b257083f5ebbc77abbc847724293c378ddf87b1ec58b4d6aaee is a malicious file sample. Reported by 3 threat sources, last seen 2026-09-02.
Detection summary
- 50 antivirus detections
- 7 IDS alerts
- 10 processes observed
- 9 contacted hosts
- 16 DNS requests
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Hybrid-Analysis | 2024-06-13 17:00:03 | 2026-09-02 21:45:08 | malicious-activity | |
| Socks5 Systemz | ThreatFox Abuse.ch | 2024-06-14 13:58:43 | 2024-06-16 13:22:42 | ||
| Socks5Systemz | MalwareBazaar Abuse.ch | 2024-06-13 16:35:15 | 2024-06-13 16:35:15 | malicious-activity |
Tags
win.socks5_systemzSample information
- Filenames
- 84545b2db5b60b257083f5ebbc77abbc847724293c378ddf87b1ec58b4d6aaee, 1afd6b7ef105ad5b4274413058f7a111.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 4813896 bytes
- MD5
1afd6b7ef105ad5b4274413058f7a111- SHA-1
e590138faf2e66f7f46583c51ffb62c264732009- SHA-256
84545b2db5b60b257083f5ebbc77abbc847724293c378ddf87b1ec58b4d6aaee- First indexed
- 2024-06-13 16:40:03
- Last updated
- 2026-09-02 21:45:08
Antivirus detections
| Engine | Detection |
|---|---|
| AVG | Win32:AdwareX-gen [Adw] |
| Avast | Win32:AdwareX-gen [Adw] |
| Avira | HEUR/AGEN.1372994 |
| Cynet | Malicious (score: 99) |
| DrWeb | Trojan.MulDrop26.51718 |
| ESET-NOD32 | a variant of Win32/TrojanDropper.Agent.SLC |
| Elastic | malicious (moderate confidence) |
| F-Secure | Heuristic.HEUR/AGEN.1372994 |
| Ikarus | Trojan.Win32.Crypt |
| Microsoft | Program:Win32/Wacapew.C!ml |
| ALYac | Trojan.GenericKD.73128413 |
| AhnLab-V3 | Trojan/Win.ICLoader.C5640973 |
| Arcabit | Trojan.Generic.D45BD9DD |
| Avira | HEUR/AGEN.1380802 |
| BitDefender | Trojan.GenericKD.73128413 |
| CTX | exe.trojan.ekstak |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| ESET-NOD32 | Win32/TrojanDropper.Agent.SZS trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.GenericKD.73128413 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1380802 |
| Fortinet | Riskware/Agent |
| GData | Trojan.GenericKD.73128413 |
| Detected | |
| Jiangmin | Trojan.Ekstak.cjih |
| K7AntiVirus | Trojan ( 005ce05c1 ) |
| K7GW | Trojan ( 005ce05c1 ) |
| Kingsoft | Win32.Trojan.Ekstak.axtyz |
| Lionic | Trojan.Win32.Ekstak.4!c |
| MaxSecure | Trojan.Malware.256170469.susgen |
| McAfeeD | ti!84545B2DB5B6 |
| MicroWorld-eScan | Trojan.GenericKD.73128413 |
| Microsoft | Trojan:Win32/ICLoader!rfn |
| Paloalto | generic.ml |
| Panda | Trj/Agent.BOT |
| Rising | Trojan.Kryptik!1.12CC3 (CLASSIC) |
| Skyhigh | BehavesLike.Win32.ObfuscatedPoly.rc |
| Sophos | Mal/Generic-S |
| Symantec | Trojan.Gen.MBT |
| Tencent | Win32.Trojan.Ekstak.Iajl |
| TrellixENS | Artemis!1AFD6B7EF105 |
| VBA32 | Trojan.ICLoader |
| VIPRE | Trojan.GenericKD.73128413 |
| Varist | W32/ABRisk.KZKD-6652 |
| Webroot | W32.Adware.Gen |
| Xcitium | Malware@#1a1kfetv0inzu |
| alibabacloud | Trojan[dropper]:Win/ICLoader.JE8PHU |
| huorong | HEUR:TrojanDropper/Agent.p |
Network contacts
45.155.250.90 185.196.9.67 152.89.198.214 91.211.247.248 173.208.215.98 192.187.101.234 209.99.187.121 109.230.199.109 141.98.234.31
DNS requests
aibgeed.ru boeedte.com bpdimwj.com bxsbjto.com iiwnjed.info ilhizgi.info kbojiqo.ua nkoobnr.net odwwkna.info pzmtsjc.ua rmdtiby.com rvckbbr.com urhbiyc.ua whfigty.com wnvmeyj.com zjkiwwc.ua
Process list
| Name | Command line |
|---|---|
| 1afd6b7ef105ad5b4274413058f7a111.exe | |
| 1afd6b7ef105ad5b4274413058f7a111.tmp | /SL5="$B01A0,4563641,54272,C:\1afd6b7ef105ad5b4274413058f7a111.exe" |
| linuxmultiMediastudio.exe | -i |
| WerFault.exe | -u -p 6308 -s 520 |
| WerFault.exe | -u -p 6308 -s 520 |
| linuxmultiMediastudio.exe | -s |
| WerFault.exe | -u -p 8304 -s 516 |
| WerFault.exe | -u -p 8304 -s 516 |
| WerFault.exe | -pss -s 440 -p 6308 -ip 6308 |
| WerFault.exe | -pss -s 512 -p 8304 -ip 8304 |