85b95128b907a8ca0288b0aff6d826119b5aaec3afe4806b897594096cb00882
Classification: Malicious
85b95128b907a8ca0288b0aff6d826119b5aaec3afe4806b897594096cb00882 is a malicious file sample. Reported by 2 threat sources, last seen 2026-09-02.
Detection summary
- 30 antivirus detections
- 0 IDS alerts
- 11 processes observed
- 6 contacted hosts
- 12 DNS requests
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Hybrid-Analysis | 2024-10-30 07:44:26 | 2026-09-02 23:45:08 | malicious-activity | |
| CredentialFlusher | MalwareBazaar Abuse.ch | 2024-10-30 07:20:48 | 2024-10-30 07:20:48 | malicious-activity |
Tags
evasiveSample information
- Filenames
- 85b95128b907a8ca0288b0aff6d826119b5aaec3afe4806b897594096cb00882, file
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 919552 bytes
- MD5
7e0177a38be142ca0e1b17462920fff1- SHA-1
866237a9b4a0789af4aef04eb89491d3cbb8ee20- SHA-256
85b95128b907a8ca0288b0aff6d826119b5aaec3afe4806b897594096cb00882- First indexed
- 2024-10-30 07:24:59
- Last updated
- 2026-09-02 23:45:08
Antivirus detections
| Engine | Detection |
|---|---|
| APEX | Malicious |
| Avira | TR/AutoIt.idbhe |
| Bkav | W32.AIDetectMalware |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Siggen29.49197 |
| ESET-NOD32 | a variant of Win32/Autoit.ORL |
| Elastic | malicious (high confidence) |
| F-Secure | Trojan.TR/AutoIt.idbhe |
| FireEye | Generic.mg.7e0177a38be142ca |
| Fortinet | AutoIt/Agent.ORL!tr |
| Detected | |
| Ikarus | Trojan.Win32.Autoit |
| Kaspersky | HEUR:Trojan.Script.Generic |
| Malwarebytes | Trojan.Injector.AutoIt |
| MaxSecure | Trojan.Malware.121218.susgen |
| McAfee | AUTOIT/Agent.t |
| McAfeeD | Real Protect-LS!7E0177A38BE1 |
| Microsoft | Trojan:Win32/CredentialFlusher.CCJG!MTB |
| NANO-Antivirus | Trojan.Script.Agent.ksrqww |
| Rising | Stealer.Browser/Autoit!1.10428 (CLASSIC) |
| Skyhigh | BehavesLike.Win32.Genericuh.ch |
| Sophos | Troj/AutoIt-DHF |
| Tencent | Unk.Win32.Script.404787 |
| VBA32 | Trojan.Autoit.Flush |
| Varist | W32/AutoIt.ABS.gen!Eldorado |
| VirIT | Trojan.Win32.AutoIt_Heur.K |
| ZoneAlarm | HEUR:Trojan.Script.Generic |
| huorong | Trojan/AutoIT.Agent.f |
Network contacts
142.251.121.95 34.107.221.82 23.32.45.201 142.250.81.234 142.251.40.131 23.40.179.157
DNS requests
detectportal.firefox.com mozilla.map.fastly.net prod.refractr.prod.webservices.mozgcp.net safebrowsing.googleapis.com shavar.prod.mozaws.net tracking-protection.prod.mozaws.net a1887.dscq.akamai.net o.pki.goog pki-goog.l.google.com prod.detectportal.prod.cloudops.mozgcp.net r10.o.lencr.org r11.o.lencr.org
Process list
| Name | Command line |
|---|---|
| file.exe | |
| taskkill.exe | taskkill /F /IM firefox.exe /T |
| taskkill.exe | taskkill /F /IM chrome.exe /T |
| taskkill.exe | taskkill /F /IM msedge.exe /T |
| taskkill.exe | taskkill /F /IM opera.exe /T |
| taskkill.exe | taskkill /F /IM brave.exe /T |
| firefox.exe | --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking |
| firefox.exe | -contentproc --channel="5244.0.1965540057\1913229577" -greomni "%PROGRAMFILES%\Mozilla Firefox\omni.ja" -appomni "%PROGRAMFILES%\Mozilla Firefox\browser\omni.ja" -appdir "%PROGRAMFILES%\Mozilla Firefox\browser" "%LOCALAPPDATA%\ow\Mozilla\Temp-{c67ee0a5-c523-46f6-82d2-1ada32c15b00}" 5244 "\\.\pipe\gecko-crash-server-pipe.5244" gpu |
| firefox.exe | -contentproc --channel="5244.3.1315795512\925424895" -childID 1 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‐’․‧
‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ�|159:4;high|194:38;{c67ee0a5-c523-46f6-82d2-1ada32c15b00}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 5244 "\\.\pipe\gecko-crash-server-pipe.5244" tab |
| firefox.exe | -contentproc --channel="5244.13.1106930947\1535554241" -childID 2 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‐’․‧
‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ�|159:4;high|194:38;{c67ee0a5-c523-46f6-82d2-1ada32c15b00}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 5244 "\\.\pipe\gecko-crash-server-pipe.5244" tab |
| firefox.exe | -contentproc --channel="5244.20.1691532562\334728224" -childID 3 -isForBrowser -intPrefs 5:50|6:-1|28:1000|34:20|35:5|36:10|45:128|46:10000|51:0|53:400|54:1|55:0|56:0|61:0|62:120|63:120|98:2|99:1|114:5000|124:0|126:0|137:10000|149:-1|154:128|155:10000|156:0|162:24|163:32768|165:0|166:0|174:5|178:1048576|179:100|180:5000|182:600|184:1|193:3|197:0|206:60000| -boolPrefs 1:0|2:0|4:0|26:1|27:1|30:0|33:1|37:1|38:0|39:0|40:0|43:1|44:1|47:0|48:0|49:0|50:0|52:0|57:1|58:1|59:0|60:1|64:1|65:1|66:0|67:1|68:1|69:0|70:1|73:0|74:0|77:1|78:1|82:1|83:1|84:1|85:0|86:0|88:0|89:0|90:1|91:0|92:1|95:1|97:0|100:1|101:0|108:0|113:0|116:1|119:1|121:1|125:0|128:1|131:1|132:1|138:1|139:0|140:1|142:0|148:0|150:1|151:0|152:1|153:1|160:0|161:0|164:1|167:0|169:1|171:1|172:0|177:0|181:1|186:0|187:0|188:0|189:1|190:0|191:1|192:1|195:0|198:0|199:0|200:1|201:1|202:0|203:1|204:1|205:1|207:0|208:0|210:0|218:1|219:1|220:0|221:0|222:0| -stringPrefs "3:7;release|96:0;|141:3;1.0|158:332; ¼½¾ǃː̷̸։֊׃״؉؊٪۔܁܂܃܄ᅟᅠ᜵ ‐’․‧
‹›⁁⁄⁒ ⅓⅔⅕⅖⅗⅘⅙⅚⅛⅜⅝⅞⅟∕∶⎮╱⧶⧸⫻⫽⿰⿱⿲⿳⿴⿵⿶⿷⿸⿹⿺⿻ 。〔〕〳゠ㅤ㈝㈞㎮㎯㏆㏟꞉︔︕︿﹝﹞．／｡ﾠ�|159:4;high|194:38;{c67ee0a5-c523-46f6-82d2-1ada32c15b00}|" -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" 5244 "\\.\pipe\gecko-crash-server-pipe.5244" tab |