84bb8bba33e1a515260b02421d72da6ad0d685d432c64c572a230337dca28c54

Classification: Malicious

84bb8bba33e1a515260b02421d72da6ad0d685d432c64c572a230337dca28c54 is a malicious file sample. Reported by 2 threat sources, last seen 2026-09-02.

Detection summary

  • 64 antivirus detections
  • 1 IDS alerts
  • 11 processes observed
  • 2 contacted hosts
  • 2 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-09-02 09:45:06 2026-09-02 21:45:05 malicious-activity
Generic.Malware MalwareBazaar Abuse.ch 2024-09-02 09:20:04 2024-09-02 09:20:04 malicious-activity

Tags

windows-server-utility

Sample information

Filenames
84bb8bba33e1a515260b02421d72da6ad0d685d432c64c572a230337dca28c54, SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
976392 bytes
MD5
e7da9da76702fefa71e67e7c2d67eb70
SHA-1
c97603e9070393fa9bb56e8674512cde49bfe444
SHA-256
84bb8bba33e1a515260b02421d72da6ad0d685d432c64c572a230337dca28c54
First indexed
2024-09-02 09:23:03
Last updated
2026-09-02 21:45:05

Antivirus detections

EngineDetection
APEXMalicious
AVGWin32:RATX-gen [Trj]
AvastWin32:RATX-gen [Trj]
BitDefenderThetaGen:NN.ZemsilCO.36812.7m2@am!3o0m
BkavW32.AIDetectMalware.CS
CrowdStrikewin/malicious_confidence_100% (D)
CylanceUnsafe
DeepInstinctMALICIOUS
ESET-NOD32a variant of MSIL/Kryptik.AMFW
Elasticmalicious (high confidence)
GoogleDetected
K7AntiVirusTrojan ( 005b396f1 )
K7GWTrojan ( 005b396f1 )
KasperskyUDS:Trojan-Spy.MSIL.Noon.gen
Kingsoftmalware.kb.c.842
MalwarebytesTrojan.MalPack.PNG.Generic
McAfeeDti!84BB8BBA33E1
SangforTrojan.Win32.Save.MSIL_Inject
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.dc
SymantecMSIL.Packed.43
VBA32TrojanLoader.MSIL.DaVinci.Heur
VaristW32/MSIL_Agent.IMZ.gen!Eldorado
VirITTrojan.Win32.MSIL_Heur.A
ZoneAlarmHEUR:Trojan-Spy.MSIL.Noon.gen
huorongTrojanSpy/MSIL.AgentTesla.mq
ALYacGen:Variant.PasswordStealer.Genie8DN.13
AVGWin32:MalwareX-gen [Rat]
AhnLab-V3Trojan/Win.RATX-gen.C5665215
AlibabaTrojanSpy:MSIL/Remcos.0ae3f216
ArcabitTrojan.PasswordStealer.Genie8DN.13
AvastWin32:MalwareX-gen [Rat]
AviraHEUR/AGEN.1377731
BitDefenderGen:Variant.PasswordStealer.Genie8DN.13
CAT-QuickHealTrojan.Ghanarava.172701067767eb70
CTXexe.trojan.msil
CrowdStrikewin/malicious_confidence_100% (W)
DrWebBackDoor.AgentTeslaNET.34
EmsisoftGen:Variant.PasswordStealer.Genie8DN.13 (B)
F-SecureHeuristic.HEUR/AGEN.1377731
FortinetMSIL/Kryptik.MQ!tr
GDataGen:Variant.PasswordStealer.Genie8DN.13
IkarusTrojan.MSIL.Inject
JiangminTrojanSpy.MSIL.ddyo
KasperskyHEUR:Trojan-Spy.MSIL.Noon.gen
LionicTrojan.Win32.Noon.l!c
MaxSecureTrojan.Malware.73691310.susgen
MicroWorld-eScanGen:Variant.PasswordStealer.Genie8DN.13
MicrosoftTrojan:MSIL/Remcos.AMAI!MTB
NANO-AntivirusTrojan.Win32.AgentTeslaNET.ksaelu
Paloaltogeneric.ml
PandaTrj/GdSda.A
RisingMalware.Obfus/[email protected] (RDM.MSIL2:aYxhWLVagorqBadfhaf4lg)
SangforSuspicious.Win32.Save.a
SophosTroj/Krypt-ABH
TencentTrojan.Msil.Kryptik.cy
TrellixENSArtemis!E7DA9DA76702
TrendMicro-HouseCallTrojan.Win32.VSX.PE04C9n
VIPREGen:Variant.PasswordStealer.Genie8DN.13
VaristW32/MSIL_Agent.INW.gen!Eldorado
XcitiumMalware@#87ivgzzfcez8
ZillyaTrojan.GenKryptik.Win32.945582
ZoneAlarmTroj/Krypt-ABH
alibabacloudTrojan[stealer]:MSIL/Leonem.Gen

Network contacts

103.186.116.236 178.237.33.50

DNS requests

blv23728.ddns.net geoplugin.net

Process list

NameCommand line
SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe
powershell.exeAdd-MpPreference -ExclusionPath "C:\SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe"
SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe
SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe/stext "%TEMP%\iuizpjmuchcwfjeznqyfxevjtzpsc"
SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe/stext "%TEMP%\iuizpjmuchcwfjeznqyfxevjtzpsc"
SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe/stext "%TEMP%\twvsqcxvypujpxadwblzirpscfhbdhxv"
SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe/stext "%TEMP%\dqbkq"
SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe/stext "%TEMP%\bcouo"
SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe/stext "%TEMP%\mwueoadu"
SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe/stext "%TEMP%\mwueoadu"
SecuriteInfo.com.BackDoor.AgentTeslaNET.34.20311.495.exe/stext "%TEMP%\oyhxpsnvkia"