jaffacakes118_Trojan-PSW.Win32.Coins.ggz.4ab12312bc3231a961fe6cf46234e6f9

Classification: Malicious

jaffacakes118_Trojan-PSW.Win32.Coins.ggz.4ab12312bc3231a961fe6cf46234e6f9 is a trojan (Windows executable, 147.5 KB). Linked to Azorult malware.

Detection summary

  • 20 antivirus detections (29% detection ratio)
  • 1 IDS alerts
  • 3 processes observed
  • 1 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Malware families: AZORULT (S0344)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Azorult Triage 2026-10-10 12:08:18 2026-10-10 12:08:18 malicious-activity S0344 Azorult
Ransom_HPBITPAYMER.SM Hybrid-Analysis 2018-08-10 05:45:52 2018-08-10 05:45:52

Tags

ransomware azorult discovery infostealer trojan

Sample information

Filenames
jaffacakes118_Trojan-PSW.Win32.Coins.ggz.4ab12312bc3231a961fe6cf46234e6f9, game.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
151040 bytes
MD5
4ab12312bc3231a961fe6cf46234e6f9
SHA-1
debc877840f2cf9bfcd8beb79194630f35d22baa
SHA-256
8b1b18b5d6f066b468e0920cf9ceab230bb476305e9156baaaf768007ced2ddf
First indexed
2018-08-10 05:45:52
Last updated
2026-10-12 07:43:46

Antivirus detections

EngineDetection
CylanceUnsafe
SUPERAntiSpywareTrojan.Agent/Gen-Kryptik
ArcabitTrojan.Generic.D2683445
Invinceaheuristic
BaiduWin32.Trojan.WisdomEyes.16070401.9500.9997
SymantecML.Attribute.HighConfidence
TrendMicro-HouseCallRansom_HPBITPAYMER.SM
KasperskyTrojan-PSW.Win32.Coins.ggz
BitDefenderTrojan.GenericKD.40383557
Endgamemalicious (high confidence)
TrendMicroRansom_HPBITPAYMER.SM
SentinelOnestatic engine - malicious
ZoneAlarmTrojan-PSW.Win32.Coins.ggz
MAXmalware (ai score=89)
Ad-AwareTrojan.GenericKD.40383557
ESET-NOD32a variant of Win32/GenKryptik.CHRL
RisingRansom.Blocker!8.12A (TFE:4:X0DwB4yYCiU)
Cybereasonmalicious.840f2c
CrowdStrikemalicious_confidence_100% (D)
Qihoo-360HEUR/QVM20.1.13D1.Malware.Gen

Network contacts

185.117.154.63

DNS requests

exox.pro

Process list

NameCommand line
game.exe
cmd.exe/c %WINDIR%\system32\timeout.exe 3 & del "game.exe"
timeout.exe3