Classification: Malicious
svchost.exe is a ransomware (application/x-dosexec, 203.0 KB). Detected by 58 antivirus engines. Linked to Chaos malware. 2 sightings, last seen 2021-11-18.
Detection summary
- 58 antivirus detections
- 0 IDS alerts
- 4 processes observed
- 0 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Chaos |
Abuse.ch |
2021-11-18 20:29:42 |
2021-11-18 20:29:42 |
malicious-activity
|
S0220 Chaos
|
| Generic.Malware |
Abuse.ch |
2021-11-18 20:29:42 |
2021-11-18 20:29:42 |
malicious-activity
|
|
Sample information
- Filenames
- svchost.exe
- File type
- application/x-dosexec
- Size
- 207872 bytes
- MD5
59ead041c3556789d19f64ef8da28a92- SHA-1
40757c931ae1c210948776065a1af3789b7a095a- SHA-256
9e98c56e8030cde3786de76a937611e79aa1eaae8eb4f5d1719c285fc6bb1d70- First indexed
- 2021-11-18 20:29:29
- Last updated
- 2026-10-15 02:58:06
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Trojan.Ransom.Filecoder |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Ransom] |
| AhnLab-V3 | Ransomware/Win.FTD.C4580180 |
| Alibaba | Ransom:Win32/FileCoder.9b09e83c |
| Antiy-AVL | Trojan[Ransom]/MSIL.Filecoder |
| Arcabit | IL:Trojan.Ransom.Chaos.110 |
| Avast | Win32:MalwareX-gen [Ransom] |
| Avira | TR/W32.MalwareX |
| BitDefender | IL:Trojan.Ransom.Chaos.110 |
| Bkav | W32.Malware.1AAF6BD |
| CAT-QuickHeal | Trojan.MsilFC.S23210427 |
| CTX | exe.trojan.msil |
| ClamAV | Win.Ransomware.Hydracrypt-9878672-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.EncoderNET.45 |
| ESET-NOD32 | MSIL/Filecoder.AJE trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | IL:Trojan.Ransom.Chaos.110 (B) |
| F-Secure | Trojan.TR/W32.MalwareX |
| Fortinet | MSIL/Filecoder.AGP!tr.ransom |
| GData | MSIL.Trojan-Ransom.Remind.B |
| Google | Detected |
| Jiangmin | Trojan.MSIL.alkzx |
| K7AntiVirus | Ransomware ( 005a8b921 ) |
| K7GW | Ransomware ( 005a8b921 ) |
| Kaspersky | HEUR:Trojan-Ransom.Win32.Generic |
| Kingsoft | malware.kb.c.1000 |
| Lionic | Trojan.MSIL.Chaos.j!c |
| Malwarebytes | Ransom.Chaos |
| MaxSecure | Trojan.Malware.10307848.susgen |
| McAfeeD | Real Protect-LS!59EAD041C355 |
| MicroWorld-eScan | IL:Trojan.Ransom.Chaos.110 |
| Microsoft | Ransom:MSIL/FileCoder.AD!MTB |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Rising | Ransom.Destructor!1.B060 (CLASSIC) |
| Sangfor | Trojan.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | GenericRXPW-PH!59EAD041C355 |
| Sophos | Troj/Ransom-GWT |
| Symantec | Ransom.Sorry |
| Tencent | Trojan-Ransom.Msil.Agent.ga |
| Trapmine | malicious.moderate.ml.score |
| TrellixENS | GenericRXPW-PH!59EAD041C355 |
| TrendMicro | TROJ_FRS.0NA103KJ21 |
| TrendMicro-HouseCall | TROJ_FRS.0NA103KJ21 |
| VBA32 | Trojan.MSIL.DelShad.Heur |
| VIPRE | IL:Trojan.Ransom.Chaos.110 |
| Varist | W32/Azorult.D.gen!Eldorado |
| VirIT | Trojan.Win32.MSIL_Heur.A |
| Xcitium | Malware@#3dqipl0x6y1ou |
| Zillya | Trojan.Filecoder.Win32.30945 |
| ZoneAlarm | Troj/Ransom-GWT |
| alibabacloud | Trojan:MSIL/ClipBanker.MO |
| huorong | Ransom/BTCware.d |
Process list
| Name | Command line |
|---|
| svchost.exe | |
| svchost.exe | |
| NOTEPAD.EXE | %APPDATA%\read_it.txt |
| dismhost.exe | {5D3A5EAA-BBCD-4847-846F-576E17714E76} |