Classification: Malicious
auto.ex_ is a ransomware (Windows executable, 104.0 KB). Flagged by 80% of antivirus engines (57 detections). Linked to Clop malware.
Detection summary
- 57 antivirus detections (80% detection ratio)
- 0 IDS alerts
- 1 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic.Ransom.Clop |
Hybrid-Analysis |
2020-07-10 01:30:27 |
2020-07-10 01:30:27 |
|
S0611 Clop
|
Sample information
- Filenames
- auto.ex_
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 106496 bytes
- MD5
6309c828dcf6b2aec630c1e9ce1887da- SHA-1
56f3b13f5b6e9f00f41cca172a68c2b0e3d6d478- SHA-256
aaa4f5bb1bd81db677b21938b03b0cd282c200a9cd0d82ef85c83805c9e8e66f- First indexed
- 2020-07-10 01:30:27
- Last updated
- 2026-09-18 05:08:56
Antivirus detections
| Engine | Detection |
|---|
| Bkav | W32.AIDetectVM.malware2 |
| MicroWorld-eScan | Generic.Ransom.Clop.9F0C07A7 |
| CAT-QuickHeal | Ransom.Clop.S5543511 |
| McAfee | RDN/Ransom |
| Cylance | Unsafe |
| Zillya | Trojan.Encoder.Win32.636 |
| Sangfor | Malware |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Alibaba | Ransom:Win32/HydraCrypt.None |
| K7GW | Trojan ( 00547de21 ) |
| K7AntiVirus | Trojan ( 00547de21 ) |
| Arcabit | Generic.Ransom.Clop.9F0C07A7 |
| Invincea | heuristic |
| Cyren | W32/Ransom.CTTB-1536 |
| Symantec | Ransom.Ploc |
| ESET-NOD32 | a variant of Win32/Filecoder.HydraCrypt.N |
| APEX | Malicious |
| Avast | Win32:Malware-gen |
| Kaspersky | Trojan-Ransom.Win32.Gen.wbg |
| BitDefender | Generic.Ransom.Clop.9F0C07A7 |
| NANO-Antivirus | Trojan.Win32.Encoder.fmyilu |
| Paloalto | generic.ml |
| AegisLab | Trojan.Win32.Encoder.tqUq |
| Rising | Ransom.Clop!1.B5ED (CLASSIC) |
| Ad-Aware | Generic.Ransom.Clop.9F0C07A7 |
| Sophos | Mal/Generic-S |
| Comodo | Malware@#12cpo1u4bfz7r |
| F-Secure | Trojan.TR/FileCoder.ruyvq |
| DrWeb | Trojan.Encoder.27233 |
| VIPRE | Trojan.Win32.Generic!BT |
| TrendMicro | Ransom.Win32.CLOP.SM1 |
| McAfee-GW-Edition | RDN/Ransom |
| FireEye | Generic.mg.6309c828dcf6b2ae |
| Emsisoft | Generic.Ransom.Clop.9F0C07A7 (B) |
| SentinelOne | DFI - Suspicious PE |
| Jiangmin | Trojan-Ransom.Encoder.a |
| Antiy-AVL | Trojan[Ransom]/Win32.Encoder |
| Microsoft | Ransom:Win32/Clop.E |
| Endgame | malicious (high confidence) |
| ViRobot | Trojan.Win32.Ransom.102912.B |
| ZoneAlarm | Trojan-Ransom.Win32.Gen.wbg |
| GData | Generic.Ransom.Clop.9F0C07A7 |
| AhnLab-V3 | Trojan/Win32.ClopRansom.C3020675 |
| ALYac | Trojan.Ransom.Clop |
| MAX | malware (ai score=82) |
| VBA32 | Malware-Cryptor.TDSS |
| Malwarebytes | Ransom.Clop |
| TrendMicro-HouseCall | Ransom.Win32.CLOP.SM1 |
| Tencent | Win32.Trojan.Gen.Wkvp |
| Yandex | Trojan.Encoder!EKvKRUlUaXA |
| Ikarus | Trojan-Ransom.HydraCrypt |
| Fortinet | W32/HydraCrypt.P!tr.ransom |
| BitDefenderTheta | Gen:NN.ZexaF.34108.gyX@aa9q3Uni |
| AVG | Win32:Malware-gen |
| Cybereason | malicious.8dcf6b |
| Panda | Trj/GdSda.A |
| Qihoo-360 | Win32/Trojan.Ransom.14a |
Process list
| Name | Command line |
|---|
| auto.ex_.exe | |