8644c17c6ff405458abb450ea224aefe37e27bad68a01bbf9d5512dc73bc1a3c
Classification: Malicious
8644c17c6ff405458abb450ea224aefe37e27bad68a01bbf9d5512dc73bc1a3c is a malicious file sample. Reported by 1 threat source, last seen 2026-09-03.
Detection summary
- 55 antivirus detections
- 1 IDS alerts
- 8 processes observed
- 3 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Hybrid-Analysis |
2024-08-06 22:30:04 |
2026-09-03 00:45:09 |
malicious-activity
|
|
Sample information
- Filenames
- 8644c17c6ff405458abb450ea224aefe37e27bad68a01bbf9d5512dc73bc1a3c, 66522f42ad8fb771d604ceba4341f5cf.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 2298591 bytes
- MD5
66522f42ad8fb771d604ceba4341f5cf- SHA-1
9f2b5c8402e012a9025e12e5e99a4a4f0d478f17- SHA-256
8644c17c6ff405458abb450ea224aefe37e27bad68a01bbf9d5512dc73bc1a3c- First indexed
- 2024-08-06 22:12:15
- Last updated
- 2026-09-03 00:45:09
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Gen:Variant.Application.FCA.3561 |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Misc] |
| Alibaba | TrojanPSW:MSIL/DCRat.77e5024c |
| Arcabit | Trojan.Uztuby.17 [many] |
| Avast | Win32:MalwareX-gen [Misc] |
| Avira | HEUR/AGEN.1380145 |
| BitDefender | Trojan.Uztuby.17 |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Trojan.Ghanarava.173097538041f5cf |
| CTX | exe.trojan.msil |
| ClamAV | Win.Trojan.Uztuby-9855059-0 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Siggen29.20260 |
| ESET-NOD32 | RAR/Agent.ER trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Uztuby.17 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1380145 |
| Fortinet | MSIL/Crypt.SS!tr.spy |
| GData | Trojan.Uztuby.17 |
| Google | Detected |
| Ikarus | Trojan.MSIL.Crypt |
| K7AntiVirus | Trojan ( 005ac5cb1 ) |
| K7GW | Trojan ( 005ac5cb1 ) |
| Kaspersky | UDS:Trojan-PSW.MSIL.Disco.gen |
| Kingsoft | MSIL.Trojan-PSW.Disco.gen |
| Lionic | Trojan.Win32.Uztuby.i!c |
| Malwarebytes | Malware.AI.3424282684 |
| MaxSecure | Trojan.Malware.115904540.susgen |
| McAfeeD | Trojan:Win/DCRat.GA |
| MicroWorld-eScan | Trojan.Uztuby.17 |
| Microsoft | Trojan:Win32/DCRat.MQ!MTB |
| NANO-Antivirus | Trojan.Win32.Disco.kqoonv |
| Paloalto | generic.ml |
| Panda | Trj/CI.A |
| Rising | Trojan.Dnoper!8.10CB3 (CLOUD) |
| Sangfor | Suspicious.Win32.Save.ins |
| SentinelOne | Static AI - Malicious SFX |
| Skyhigh | BehavesLike.Win32.Dropper.vc |
| Sophos | Troj/Krypt-AEV |
| Symantec | Trojan Horse |
| Tencent | Trojan.Msil.Kryptik.ce |
| TrellixENS | Artemis!66522F42AD8F |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04C9z |
| VBA32 | TrojanPSW.MSIL.Disco |
| VIPRE | Trojan.Uztuby.17 |
| Varist | W32/MSIL_Kryptik.KIJ.gen!Eldorado |
| VirIT | Trojan.Win32.Genus.WFX |
| Xcitium | Malware@#crd3u5nhhjk7 |
| ZoneAlarm | Troj/Krypt-AEV |
| alibabacloud | Trojan[stealer]:MSIL/DCRat.MR8PHU |
| huorong | Backdoor/MSIL.DCRat.l |
Process list
| Name | Command line |
|---|
| 66522f42ad8fb771d604ceba4341f5cf.exe | |
| WScript.exe | "C:\msfontintobroker\VkNCYEUC1upHrhgwQf7JvasJjeEXTbsD23UGUXhAftNKdI7488oFOIY2lO0x.vbe" |
| cmd.exe | %WINDIR%\system32\cmd.exe /c ""C:\msfontintobroker\NGVJ44.bat" " |
| Intodhcp.exe | |
| cmd.exe | /C "%TEMP%\IASIrEL6Vt.bat" |
| chcp.com | chcp 65001 |
| w32tm.exe | w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 |
| conhost.exe | |