faceshop.io_ransome.exe
Classification: Malicious
faceshop.io_ransome.exe is a malicious file sample. Linked to Nanocore malware. Reported by 1 threat source, last seen 2026-09-02.
Detection summary
- 49 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: NANOCORE (S0336)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Nanocore | Triage | 2026-09-02 23:59:24 | 2026-09-02 23:59:24 | malicious-activity | S0336 NanoCore |
Tags
nanocore defense_evasion discovery execution impact keylogger persistence privilege_escalation ransomware spyware stealer trojanSample information
- Filenames
- faceshop.io_ransome.exe
- SHA-256
a8472059363d32d736391a95acab3c346a128ddbb1f3e90d4d6397192fe20c20- First indexed
- 2026-09-02 23:59:24
- Last updated
- 2026-09-02 23:59:24
Antivirus detections
| Engine | Detection |
|---|---|
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Ransom] |
| AhnLab-V3 | Ransomware/Win.HiddenTears.C5880886 |
| Antiy-AVL | Trojan[Ransom]/Win32.HiddenTears |
| Arcabit | Trojan.Ransom.HiddenTears.1 |
| Avast | Win32:MalwareX-gen [Ransom] |
| Avira | TR/Dropper.Gen |
| BitDefender | Gen:Heur.Ransom.HiddenTears.1 |
| Bkav | W32.Malware.7298E127 |
| CTX | exe.ransomware.hiddentears |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Siggen32.40519 |
| ESET-NOD32 | MSIL/Agent.YGX trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Heur.Ransom.HiddenTears.1 (B) |
| F-Secure | Trojan.TR/Dropper.Gen |
| Fortinet | MSIL/Agent.EGC!tr |
| GData | Gen:Heur.Ransom.HiddenTears.1 |
| Detected | |
| K7AntiVirus | Spyware ( 700000201 ) |
| K7GW | Spyware ( 700000201 ) |
| Kaspersky | HEUR:Trojan-Ransom.MSIL.RDCry.gen |
| Kingsoft | malware.kb.c.889 |
| Malwarebytes | Spyware.KeyLogger |
| MaxSecure | Trojan.Malware.300983.susgen |
| McAfeeD | Real Protect-LS!35C050F4A443 |
| MicroWorld-eScan | Gen:Heur.Ransom.HiddenTears.1 |
| Microsoft | Ransom:Win32/HiddenTears.ARR!MTB |
| Panda | Trj/GdSda.A |
| Rising | Malware.Undefined!8.C (TFE:dGZlOg3/RQC6O2DFkQ) |
| Sangfor | Suspicious.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Sophos | Troj/NanoCr-PK |
| Symantec | ML.Attribute.HighConfidence |
| TACHYON | Trojan/W32.DN-Agent.40448.CF |
| Tencent | Trojan-Ransom.Win32.Dcrypt.16003863 |
| Trapmine | suspicious.low.ml.score |
| TrellixENS | GenericRXWW-MF!35C050F4A443 |
| TrendMicro | Ransom.MSIL.CRYPTOLOCKER.SM.hp |
| TrendMicro-HouseCall | Ransom.MSIL.CRYPTOLOCKER.SM.hp |
| VBA32 | TScope.Trojan.MSIL |
| VIPRE | Gen:Heur.Ransom.HiddenTears.1 |
| Varist | W32/NanoCore.P.gen!Eldorado |
| Webroot | W32.Malware.Gen |
| Zillya | Trojan.AgentGen.Win32.112 |
| ZoneAlarm | Troj/NanoCr-PK |
| huorong | Ransom/LockFile.kg |