Classification: Malicious
200062350.tmp is a trojan (application/x-dosexec, 1.6 MB). Detected by 67 antivirus engines. Linked to Fatduke malware. 56 sightings, last seen 2025-08-04.
Detection summary
- 67 antivirus detections
- 1 IDS alerts
- 3 processes observed
- 1 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Hybrid-Analysis |
2025-08-04 12:45:06 |
2025-08-04 13:30:17 |
|
|
| FatDuke |
ThreatFox Abuse.ch |
2024-04-25 15:23:59 |
2024-04-27 15:20:52 |
|
S0512 FatDuke
|
| Worm.Fadok |
MalwareBazaar Abuse.ch |
2024-04-24 15:02:33 |
2024-04-24 15:02:33 |
malicious-activity
|
|
Tags
win.fatduke
downloader
Sample information
- Filenames
- b570f694c37aa5184d86a9a6c903bedec10d53f5ae5979ca047a25b43ce62575, 200062350.tmp
- File type
- application/x-dosexec
- Size
- 1653248 bytes
- MD5
301a50dbf2903823a87860c5fcd8941d- SHA-1
180936e169c0b303d89aef3ee3e01083b8b4219f- SHA-256
b570f694c37aa5184d86a9a6c903bedec10d53f5ae5979ca047a25b43ce62575- First indexed
- 2024-04-24 16:24:30
- Last updated
- 2026-09-03 03:17:40
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Dropped:Generic.Malware.SFMHX.F4159669 |
| APEX | Malicious |
| AVG | Win32:MalwareX-gen [Wrm] |
| Acronis | suspicious |
| AhnLab-V3 | Worm/Win32.Fadok.R189010 |
| Alibaba | Malware:Win32/km_2c96a.None |
| Antiy-AVL | Trojan/Win32.Scar.jfya |
| Arcabit | Generic.Malware.SFMHX.FD3F78B5 |
| Avast | Win32:MalwareX-gen [Wrm] |
| Avira | TR/ATRAPS.Gen4 |
| Baidu | Win32.Worm.FakeDoc.a |
| BitDefender | Dropped:Generic.Malware.SFMHX.F4159669 |
| Bkav | W32.FakeDocVDb.Worm |
| CAT-QuickHeal | Worm.Fadok.A5 |
| CTX | exe.trojan.fakedoc |
| ClamAV | Win.Malware.Razy-6723913-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Win32.HLLW.Rendoc.3 |
| ESET-NOD32 | Win32/FakeDoc.A worm |
| Elastic | malicious (high confidence) |
| Emsisoft | Worm.FakeDoc (A) |
| F-Secure | Trojan.TR/ATRAPS.Gen4 |
| Fortinet | W32/FakeDoc.A!worm |
| GData | Win32.Trojan.Doc.A |
| Google | Detected |
| Gridinsoft | Trojan.Win32.Agent.dd!s1 |
| Ikarus | Worm.Win32.Fadok |
| Jiangmin | Worm.Agent.ju |
| K7AntiVirus | EmailWorm ( 005a5bee1 ) |
| K7GW | EmailWorm ( 005a5bee1 ) |
| Kaspersky | Worm.Win32.FakeDoc.ifdy |
| Kingsoft | Win32.HeurC.KVM007.a |
| Lionic | Trojan.Win32.Agent.tnEr |
| Malwarebytes | Generic.Malware.Gen.DDS |
| MaxSecure | Trojan.Agent.ifdx |
| McAfeeD | ti!B570F694C37A |
| MicroWorld-eScan | Dropped:Generic.Malware.SFMHX.F4159669 |
| Microsoft | Worm:Win32/Fadok.A |
| NANO-Antivirus | Trojan.Win32.FakeDoc.kcipqh |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Rising | Worm.Fadok!1.A753 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-FakeDoc |
| Sangfor | Trojan.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Generic.th |
| Sophos | Troj/FakeDoc-B |
| Symantec | SMG.Heur!gen |
| Tencent | Trojan.Win32.FakeDoc.ha |
| Trapmine | malicious.high.ml.score |
| TrellixENS | GenericRXAH-AG!301A50DBF290 |
| TrendMicro | WORM_FAKEDOC_FD050240.UVPM |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04C9t |
| VBA32 | Trojan.Agent |
| VIPRE | Dropped:Generic.Malware.SFMHX.F4159669 |
| Varist | W32/FakeDoc.F.gen!Eldorado |
| VirIT | Trojan.Win32.ATRAPS.CTTT |
| Xcitium | TrojWare.Win32.Scar.FAKD@5xdxi2 |
| Yandex | Trojan.GenAsa!Vwr6EnNJt6I |
| Zillya | Trojan.Scar.Win32.88546 |
| ZoneAlarm | Troj/FakeDoc-B |
| Zoner | Trojan.Win32.61633 |
| alibabacloud | Trojan:Win/Fakedoc |
| huorong | Worm/FakeDoc.b |
Process list
| Name | Command line |
|---|
| b570f694c37aa5184d86a9a6c903bedec10d53f5ae5979ca047a25b43ce62575.exe | |
| WINWORD.EXE | /n "C:\b570f694c37aa5184d86a9a6c903bedec10d53f5ae5979ca047a25b43ce62575.docx" |
| mls.exe | -s |