84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799

Classification: Malicious

84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799 is a malicious file sample. Reported by 1 threat source, last seen 2026-09-02.

Detection summary

  • 77 antivirus detections
  • 1 IDS alerts
  • 79 processes observed
  • 5 contacted hosts
  • 2 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-01-29 16:30:03 2026-09-02 21:45:04 malicious-activity

Tags

evasive windows-server-utility

Sample information

Filenames
84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799, file
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
7656448 bytes
MD5
6af4b8b8c8399fca6798e3f2d7df9af5
SHA-1
7cc85c826668d6f09b43ea9358ecdc57fecf398b
SHA-256
84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799
First indexed
2024-01-29 16:14:06
Last updated
2026-09-02 21:45:04

Antivirus detections

EngineDetection
APEXMalicious
AVGWin32:DropperX-gen [Drp]
AhnLab-V3Malware/Win.Generic.C4478643
ArcabitIL:Trojan.MSILZilla.D26A3
AvastWin32:DropperX-gen [Drp]
AviraHEUR/AGEN.1365025
BitDefenderIL:Trojan.MSILZilla.9891
BitDefenderThetaGen:NN.ZemsilF.36680.@p0@aSAZrBc
BkavW32.AIDetectMalware.CS
ClamAVWin.Packed.Msilzilla-10018301-0
CrowdStrikewin/malicious_confidence_100% (D)
Cybereasonmalicious.26668d
Cylanceunsafe
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
DrWebTrojan.MulDropNET.43
ESET-NOD32a variant of MSIL/Agent.UZA
Elasticmalicious (high confidence)
EmsisoftIL:Trojan.MSILZilla.9891 (B)
F-SecureHeuristic.HEUR/AGEN.1365025
FireEyeGeneric.mg.6af4b8b8c8399fca
FortinetMSIL/GenKryptik.FFMZ!tr
GDataIL:Trojan.MSILZilla.9891
GoogleDetected
IkarusTrojan.MSIL.Krypt
K7AntiVirusRansomware ( 005a8b921 )
K7GWRansomware ( 005a8b921 )
KasperskyHEUR:Trojan-Downloader.MSIL.ShortLoader.gen
Kingsoftmalware.kb.c.1000
MAXmalware (ai score=84)
MalwarebytesTrojan.Crypt.MSIL.Generic
MaxSecureTrojan.Malware.300983.susgen
McAfeeGenericRXOO-YN!6AF4B8B8C839
MicroWorld-eScanIL:Trojan.MSILZilla.9891
MicrosoftTrojan:MSIL/Mokes.B!MTB
PandaTrj/GdSda.A
RisingTrojan.AntiVM!1.CF63 (CLASSIC)
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.wc
SophosTroj/ILAgent-I
SymantecML.Attribute.HighConfidence
VBA32Trojan.MSIL.Injector.gen
VIPREIL:Trojan.MSILZilla.9891
VaristW32/MSIL_Kryptik.FFY.gen!Eldorado
ZoneAlarmHEUR:Trojan-Downloader.MSIL.ShortLoader.gen
ALYacGen:Variant.Jalapeno.293
AVGWin32:MalwareX-gen [Drp]
AlibabaTrojanDownloader:MSIL/Mokes.79a2e42f
Antiy-AVLTrojan/Win32.Agent
ArcabitTrojan.Jalapeno.293
AvastWin32:MalwareX-gen [Drp]
BitDefenderGen:Variant.Jalapeno.293
BkavW32.Common.D693AFB0
CAT-QuickHealTrojan.Ghanarava.1727030270df9af5
CTXexe.trojan.msil
CylanceUnsafe
EmsisoftGen:Variant.Jalapeno.293 (B)
GDataGen:Variant.Jalapeno.293
GridinsoftRansom.Win32.STOP.dg!n
JiangminTrojanDownloader.MSIL.aqbx
KingsoftMSIL.Trojan-Downloader.ShortLoader.gen
LionicTrojan.Win32.ShortLoader.a!c
McAfeeDReal Protect-LS!6AF4B8B8C839
MicroWorld-eScanGen:Variant.Jalapeno.293
NANO-AntivirusTrojan.Win32.ShortLoader.khyxhv
Paloaltogeneric.ml
TencentMalware.Win32.Gencirc.13ff46c4
Trapminemalicious.high.ml.score
TrellixENSGenericRXOO-YN!6AF4B8B8C839
TrendMicro-HouseCallTrojan.Win32.VSX.PE04C9j
VIPREGen:Variant.Jalapeno.293
XcitiumMalware@#edov5qw52or6
ZillyaTrojan.Agent.Win32.3854582
ZoneAlarmTroj/ILAgent-I
alibabacloudTrojan:MSIL/Mokes.B!MTB
huorongVirTool/MSIL.Obfuscator.su

Network contacts

185.172.128.90 5.42.64.33 185.172.128.109 154.92.15.189 185.172.128.79

DNS requests

app.alie3ksgaa.com i.alie3ksgaa.com

Process list

NameCommand line
file.exe
InstallSetup9.exe
BroomSetup.exe
cmd.exe%WINDIR%\system32\cmd.exe /c ""%APPDATA%\Temp\Task.bat" "
chcp.comchcp 1251
schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'%TEMP%\Updater.exe'" /sc minute /mo 30 /F
nsd67A7.tmp
toolspub1.exe
WerFault.exe-u -p 1344 -s 556
31839b57a4f11171d6abc8bbc4451ee4.exe
WerFault.exe-u -p 4788 -s 448
WerFault.exe-u -p 4788 -s 468
WerFault.exe-u -p 4788 -s 456
WerFault.exe-u -p 4788 -s 568
WerFault.exe-u -p 4788 -s 676
WerFault.exe-u -p 4788 -s 684
WerFault.exe-u -p 4788 -s 668
WerFault.exe-u -p 4788 -s 692
WerFault.exe-u -p 4788 -s 728
WerFault.exe-u -p 4788 -s 736
WerFault.exe-u -p 4788 -s 820
WerFault.exe-u -p 4788 -s 708
WerFault.exe-u -p 4788 -s 860
WerFault.exe-u -p 4788 -s 880
WerFault.exe-u -p 4788 -s 876
WerFault.exe-u -p 4788 -s 808
WerFault.exe-u -p 4788 -s 896
WerFault.exe-u -p 4788 -s 876
WerFault.exe-u -p 4788 -s 836
WerFault.exe-u -p 4788 -s 884