TWI-SHA 202102.exe
Classification: Malicious
TWI-SHA 202102.exe is a trojan (application/x-dosexec). Detected by 36 antivirus engines. Linked to Guloader malware. 4 sightings, last seen 2021-05-07.
Detection summary
- 36 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: GULOADER (S0561)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| GuLoader | Abuse.ch | 2021-05-07 08:10:05 | 2021-05-07 08:10:05 | malicious-activity | S0561 GuLoader |
Sample information
- Filenames
- TWI-SHA 202102.exe
- File type
- application/x-dosexec
- MD5
6f693dc1eeb7103ec6a4cc3ded4e5f7b- SHA-1
c02f0f5cec56c9d85d9bb26625bd367d64e24dc8- SHA-256
9e3fdcc393fc96ce693041533b4ecc9e43d57ad1bca40c99d07713dc90d39bd4- First indexed
- 2021-05-07 10:15:04
- Last updated
- 2026-10-09 05:29:34
Antivirus detections
| Engine | Detection |
|---|---|
| Bkav | W32.AIDetect.malware1 |
| Elastic | malicious (high confidence) |
| FireEye | Trojan.GenericKD.36854630 |
| ALYac | Trojan.GenericKD.36854630 |
| AegisLab | Trojan.Win32.Remcos.m!c |
| Sangfor | Trojan.Win32.Save.a |
| K7AntiVirus | Riskware ( 0040eff71 ) |
| Alibaba | Backdoor:Win32/Remcos.b76835ba |
| K7GW | Riskware ( 0040eff71 ) |
| Cybereason | malicious.1eeb71 |
| BitDefenderTheta | Gen:NN.ZevbaF.34688.em0@aKojZnmi |
| Cyren | W32/VB_Troj.BJ.gen!Eldorado |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | a variant of Win32/Injector.EPHE |
| APEX | Malicious |
| Paloalto | generic.ml |
| Cynet | Malicious (score: 100) |
| BitDefender | Trojan.GenericKD.36854630 |
| MicroWorld-eScan | Trojan.GenericKD.36854630 |
| Rising | Trojan.Woreflint!8.F5EA (TFE:5:Ay2No73yQcV) |
| Ad-Aware | Trojan.GenericKD.36854630 |
| Sophos | Mal/Generic-S |
| McAfee-GW-Edition | BehavesLike.Win32.Trojan.lm |
| Emsisoft | Trojan.GenericKD.36854630 (B) |
| Ikarus | Trojan.VB.Crypt |
| GData | Trojan.GenericKD.36854630 |
| Avira | TR/Injector.xlpdv |
| Kingsoft | Win32.Hack.Remcos.s.(kcloud) |
| ZoneAlarm | Backdoor.Win32.Remcos.swu |
| Microsoft | Trojan:Win32/VBObfuse.BB!MTB |
| MAX | malware (ai score=83) |
| TrendMicro-HouseCall | TROJ_GEN.F0D1C00E621 |
| Tencent | Win32.Backdoor.Remcos.Wrqv |
| Fortinet | PossibleThreat.PALLAS.H |
| Panda | Trj/GdSda.A |
| CrowdStrike | win/malicious_confidence_80% (W) |