mu-311020.exe

Classification: Malicious

mu-311020.exe is a trojan (Windows 64-bit executable, 4.3 MB). Flagged by 69% of antivirus engines (78 detections). Linked to Windigo activity.

Detection summary

  • 78 antivirus detections (69% detection ratio)
  • 1 IDS alerts
  • 2 processes observed
  • 32 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: WINDIGO (G0124)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Trojan.Windigo Hybrid-Analysis 2020-12-29 10:15:12 2020-12-29 10:15:12 G0124 Windigo

Sample information

Filenames
mu-311020.exe
File type
PE32+ executable (console) x86-64 (stripped to ext ...
Size
4521472 bytes
MD5
9e805e2a4a42579b991c55db964ae3ba
SHA-1
6bf1757f3d32a14efa88e54bcb62802dc4490701
SHA-256
9338a123b1d6904c53eb7225a5a64423d031ac3a0c5bcc7e01b3f725f32d2b35
First indexed
2020-12-29 10:15:12
Last updated
2026-09-24 19:17:17

Antivirus detections

EngineDetection
MicroWorld-eScanTrojan.GenericKD.44351951
CAT-QuickHealTrojan.Multi
McAfeeArtemis!9E805E2A4A42
CylanceUnsafe
SangforMalware
K7AntiVirusTrojan ( 0057240d1 )
AlibabaTrojan:Win32/Windigo.e41d33c7
K7GWTrojan ( 0057240d1 )
Cybereasonmalicious.a4a425
CyrenW64/Trojan.PPLY-9131
AvastWin64:Malware-gen
KasperskyTrojan.Win32.Windigo.ew
BitDefenderTrojan.GenericKD.44351951
NANO-AntivirusTrojan.Win64.Windigo.ibqafj
Paloaltogeneric.ml
Ad-AwareTrojan.GenericKD.44351951
EmsisoftTrojan.GenericKD.44351951 (B)
ComodoMalware@#3aqrtn0qpy47b
F-SecureTrojan.TR/Redcap.jdoqz
VIPRETrojan.Win32.Generic!BT
TrendMicroTROJ_GEN.R06BC0WK320
McAfee-GW-EditionBehavesLike.Win64.Generic.rh
FireEyeTrojan.GenericKD.44351951
SophosMal/Generic-S
GDataTrojan.GenericKD.44351951
WebrootW32.Trojan.Gen
AviraTR/Redcap.jdoqz
Antiy-AVLTrojan/Win32.Windigo
GridinsoftTrojan.Win64.Gen.vb
ArcabitTrojan.Generic.D2A4C1CF
AegisLabTrojan.Win32.Windigo.4!c
ZoneAlarmTrojan.Win32.Windigo.ew
MicrosoftTrojan:Win32/Ymacco.AA93
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win64.Windigo.C4223489
ALYacTrojan.GenericKD.44351951
MAXmalware (ai score=85)
VBA32Trojan.Windigo
MalwarebytesTrojan.Glupteba
ESET-NOD32a variant of Win64/RanumBot.A
TrendMicro-HouseCallTROJ_GEN.R06BC0WK320
YandexTrojan.Windigo!kfFdaDiYzYk
IkarusTrojan.Instructions
FortinetW32/Windigo.A!tr
MaxSecureTrojan.Malware.109251598.susgen
AVGWin64:Malware-gen
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Win32/Trojan.71c
ALYacGeneric.Gluteba.1.ED038C82
AlibabaTrojan:Win32/Windigo.3687f32d
ArcabitGeneric.Gluteba.1.ED038C82
BitDefenderGeneric.Gluteba.1.ED038C82
BkavW32.Common.548DD4DC
CAT-QuickHealTrojan.Ghanarava.17208655844ae3ba
CTXexe.trojan.windigo
ClamAVWin.Malware.Windigo-9851324-0
CynetMalicious (score: 99)
DeepInstinctMALICIOUS
ESET-NOD32a variant of WinGo/RanumBot.AF
Elasticmalicious (moderate confidence)
EmsisoftGeneric.Gluteba.1.ED038C82 (B)
GDataGeneric.Gluteba.1.ED038C82
GoogleDetected
GridinsoftTrojan.Win64.Agent.dd!s1
LionicTrojan.Win32.Windigo.4!c
McAfeeDti!9338A123B1D6
MicroWorld-eScanGeneric.Gluteba.1.ED038C82
MicrosoftTrojan:Win32/Wacatac.B!ml
RisingTrojan.Glupteba!1.D6C0 (CLASSIC)
SangforTrojan.Win32.Windigo.Vzjr
TencentWin32.Trojan.Windigo.Dkjl
TrellixENSArtemis!9E805E2A4A42
VIPREGeneric.Gluteba.1.ED038C82
VaristW64/ABTrojan.PPLY-9131
alibabacloudTrojan:Multi/WinGo_RanumBot_D
huorongWorm/WannaMine.d
tehtrisGeneric.Malware

Network contacts

15.67.0.32 15.67.0.33 15.67.0.34 15.67.0.35 15.67.0.36 15.67.0.37 15.67.0.38 15.67.0.39 15.67.0.41 15.67.0.40 15.67.0.42 15.67.0.48 15.67.0.47 15.67.0.49 15.67.0.50 15.67.0.51 15.67.0.52 15.67.0.53 15.67.0.55 15.67.0.54 15.67.0.56 15.67.0.57 15.67.0.58 15.67.0.59 15.67.0.60 15.67.0.62 15.67.0.61 15.67.0.63 15.67.0.64 15.67.0.65 15.67.0.66 15.67.0.67

Process list

NameCommand line
mu-311020.exe
DismHost.exe{8CEA22B4-560E-4E41-B5C5-CDF8009BA0D7}