decryptor.exe

Classification: Malicious

decryptor.exe is a trojan (application/x-dosexec, 108.0 KB). Flagged by 75% of antivirus engines (77 detections). Linked to Conti malware.

Detection summary

  • 77 antivirus detections (75% detection ratio)
  • 0 IDS alerts
  • 1 processes observed
  • 32 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: CONTI (S0575)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Cyber Threat Alliance 2026-09-17 10:18:29 2026-09-17 10:18:29 malicious-activity
Generic Malware Hybrid-Analysis 2023-01-30 15:30:04 2026-05-15 03:45:04
Conti MalwareBazaar Abuse.ch 2022-03-02 11:08:04 2022-03-02 11:08:04 malicious-activity S0575 Conti
Generic.Malware MalwareBazaar Abuse.ch 2022-03-02 11:08:04 2022-03-02 11:08:04 malicious-activity

Tags

ransomware

Sample information

Filenames
decryptor.exe, 9aed278f54f65e546fb9f7f34dff26d0835a0a21a5a4fc4c026bf84596ed277e
File type
application/x-dosexec
Size
110592 bytes
MD5
31ee2755a455b1c8c743f51cec3845fd
SHA-1
7d325a2deb3278aab4ddff7239198179fe1b73b4
SHA-256
9aed278f54f65e546fb9f7f34dff26d0835a0a21a5a4fc4c026bf84596ed277e
First indexed
2022-03-02 12:15:05
Last updated
2026-05-15 03:45:04

Antivirus detections

EngineDetection
LionicTrojan.Win32.Conti.4!c
MicroWorld-eScanTrojan.GenericKD.48608805
FireEyeGeneric.mg.31ee2755a455b1c8
CAT-QuickHealTrojan.GenericRI.S27067696
ALYacTrojan.Ransom.Conti
CylanceUnsafe
ZillyaTrojan.Filecoder.Win32.22824
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 005747b51 )
AlibabaRansom:Win32/ContiCrypt.5eb2efb8
K7GWTrojan ( 005747b51 )
Cybereasonmalicious.5a455b
VirITRansom.Win32.Conti.DGE
CyrenW32/Conti.D.gen!Eldorado
SymantecML.Attribute.HighConfidence
ElasticWindows.Ransomware.Conti
ESET-NOD32a variant of Win32/Filecoder.Conti.I
APEXMalicious
CynetMalicious (score: 100)
BitDefenderTrojan.GenericKD.48608805
NANO-AntivirusTrojan.Win32.Encoder.jqkhjw
AvastWin32:Conti-B [Ransom]
TencentWin32.Trojan.Filecoder.Pnkl
Ad-AwareTrojan.GenericKD.48608805
EmsisoftTrojan.GenericKD.48608805 (B)
ComodoMalware@#1ly2icuq6d4m3
DrWebTrojan.Encoder.35035
VIPRETrojan.GenericKD.48608805
TrendMicroRansom.Win32.CONTI.SMYXBBU
McAfee-GW-EditionBehavesLike.Win32.NetLoader.ch
SophosMal/Generic-S
IkarusTrojan-Ransom.Conti
GDataTrojan.GenericKD.48608805
JiangminTrojan.Johnnie.db
WebrootW32.Trojan.Gen
AviraTR/Redcap.lxffy
Antiy-AVLTrojan/Generic.ASMalwS.788A
ArcabitTrojan.Generic.D2E5B625
MicrosoftRansom:Win32/ContiCrypt.PADD!MTB
GoogleDetected
AhnLab-V3Malware/Win.Generic.C4705965
Acronissuspicious
McAfeeRDN/Ransom
MAXmalware (ai score=100)
VBA32BScope.Trojan.Wacatac
MalwarebytesRansom.Conti
RisingRansom.Conti!1.D637 (CLASSIC)
SentinelOneStatic AI - Suspicious PE
MaxSecureTrojan.Malware.185737237.susgen
FortinetW32/Conti.I!tr
BitDefenderThetaGen:NN.ZexaF.34784.gyW@ae9oLVgi
AVGWin32:Conti-B [Ransom]
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Johnnie.285717
ALYacGen:Variant.Johnnie.285717
SangforRansom.Win32.ContiCrypt.PADD!MTB
AlibabaRansom:Win32/ContiCrypt.b1f033f7
Paloaltogeneric.ml
BitDefenderGen:Variant.Johnnie.285717
TencentWin32.Trojan.Filecoder.Lkoc
Ad-AwareGen:Variant.Johnnie.285717
F-SecureTrojan.TR/Redcap.lxffy
McAfee-GW-EditionBehavesLike.Win32.Worm.ch
EmsisoftGen:Variant.Johnnie.285717 (B)
GDataGen:Variant.Johnnie.285717
Antiy-AVLTrojan[Ransom]/Win32.Conti
GridinsoftRansom.Win32.Conti.sa
ArcabitTrojan.Johnnie.D45C15
ViRobotTrojan.Win32.Z.Conti.110592
McAfeeArtemis!31EE2755A455
MAXmalware (ai score=86)
RisingRansom.Conti!1.D637 (CLOUD)
YandexTrojan.Filecoder!rPOQUtq0oVI
BitDefenderThetaGen:NN.ZexaF.34264.gyW@ae9oLVgi
MaxSecureTrojan.Malware.300983.susgen

Network contacts

192.168.0.0 192.168.0.1 192.168.0.2 192.168.0.3 192.168.0.4 192.168.0.5 192.168.0.6 192.168.0.7 192.168.0.8 192.168.0.9 192.168.0.10 192.168.0.11 192.168.0.12 192.168.0.13 192.168.0.14 192.168.0.15 192.168.0.16 192.168.0.17 192.168.0.18 192.168.0.19 192.168.0.20 192.168.0.21 192.168.0.22 192.168.0.23 192.168.0.24 192.168.0.25 192.168.0.26 192.168.0.27 192.168.0.28 192.168.0.29 192.168.0.30 192.168.0.31

Process list

NameCommand line
decryptor.exe