tloader.exe

Classification: Malicious

tloader.exe is a malicious file sample (Windows executable, 1.6 MB). Flagged by 29% of antivirus engines (21 detections). Linked to Apt37 activity.

Detection summary

  • 21 antivirus detections (29% detection ratio)
  • 0 IDS alerts
  • 5 processes observed
  • 0 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Intrusion sets: APT37 (G0067)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Apt37 Maltiverse 2023-07-04 04:28:50 2023-07-05 20:51:08 malicious-activity G0067 APT37
Generic Malware Hybrid-Analysis 2023-01-18 17:45:04 2023-01-18 17:45:04

Tags

apt

Sample information

Filenames
tloader.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
1644088 bytes
MD5
08beae44c872be9929a79c812534494f
SHA-1
1d23590d1fe6b407bd209eb78132bee25e81d1d0
SHA-256
a2ddaa327b7712ee58f7809794540157d2433bd27aca885cdc98893cf8eebf53
First indexed
2023-01-18 17:23:35
Last updated
2023-07-05 20:51:08

Antivirus detections

EngineDetection
Elasticmalicious (high confidence)
K7GWHacktool ( 700007861 )
ArcabitTrojan.Babar.D229EF
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/GenKryptik.GEXE
APEXMalicious
BitDefenderGen:Variant.Babar.141807
MicroWorld-eScanGen:Variant.Babar.141807
RisingTrojan.Kryptik!8.8 (TFE:5:t71zp8wqthG)
EmsisoftGen:Variant.Babar.141807 (B)
McAfee-GW-EditionBehavesLike.Win32.MultiPlug.tc
Trapminemalicious.moderate.ml.score
FireEyeGeneric.mg.08beae44c872be99
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
GDataGen:Variant.Babar.141807
MAXmalware (ai score=82)
VBA32Malware-Cryptor.Limpopo
CylanceUnsafe
SentinelOneStatic AI - Suspicious PE
BitDefenderThetaGen:NN.ZexaF.36212.Kv1@aSdIQTdO
CrowdStrikewin/malicious_confidence_70% (D)

DNS requests

cmtysfkzlu9drsfddwhhiqyttt5ha.lkvw5prcbylhlcgausp4xwsriwoa5zj

Process list

NameCommand line
tloader.exe
WScript.exe"%TEMP%\adrcrroakmljgbslnmpkuwyrlplgmnjo.vbs"
WerFault.exe-u -p 7824 -s 512
update.exe
svchost.exe