2026-04-03_3b46a729db7ae6af8b19711c9452194d_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_njrat_quasar-rat_salatstealer_sliver_smoke-loader
Classification: Malicious
2026-04-03_3b46a729db7ae6af8b19711c9452194d_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_njrat_quasar-rat_salatstealer_sliver_smoke-l…
Detection summary
- 53 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Intrusion sets: THE GENTLEMEN (G1058)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Cyber Threat Alliance | 2026-08-08 10:03:16 | 2026-09-09 10:07:57 | malicious-activity | |
| Gentlemen | Triage | 2026-06-04 14:45:36 | 2026-06-04 14:45:36 | malicious-activity | |
| Gentlemen | ThreatFox Abuse.ch | 2026-05-13 15:06:15 | 2026-05-13 15:25:04 | ||
| The Gentlemen ransomware Windows encryptor payload | Check Point Research | 2026-05-13 00:00:00 | 2026-05-13 00:00:00 | malicious-activity | G1058 The Gentlemen |
| Generic Malware | Triage | 2026-04-03 10:06:30 | 2026-04-03 10:06:30 | malicious-activity |
Tags
execution win.gentlemen gentlemen ransomware payload the-gentlemenSample information
- Filenames
- b67958afc982cafbe1c3f114b444d7f4c91a88a3e7a86f89ab8795ac2110d1e6, 2026-04-03_3b46a729db7ae6af8b19711c9452194d_amadey_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-stealer_njrat_quasar-rat_salatstealer_sliver_smoke-loader
- MD5
3b46a729db7ae6af8b19711c9452194d- SHA-1
5aea74bf3e70f38eb596f8002b3c02514daee4f0- SHA-256
b67958afc982cafbe1c3f114b444d7f4c91a88a3e7a86f89ab8795ac2110d1e6- First indexed
- 2025-09-09 00:00:00
- Last updated
- 2026-09-10 06:09:40
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.Ransom.Gentleman |
| AVG | Win64:MalwareX-gen [Ransom] |
| AhnLab-V3 | Ransomware/Win.BlackByte.R769051 |
| Alibaba | Ransom:Win64/BlackByte.b30ec052 |
| Arcabit | Generic.Ransom.Gentlemen.A.CF8D32C8 |
| Avast | Win64:MalwareX-gen [Ransom] |
| Avira | TR/W64.MalwareX |
| BitDefender | Generic.Ransom.Gentlemen.A.CF8D32C8 |
| Bkav | W32.Malware.BEFB056A |
| CAT-QuickHeal | Ransom.Gentlemen.S38826063 |
| CTX | exe.ransomware.blackbyte |
| ClamAV | Win.Tool.Garble-10044180-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 99) |
| DeepInstinct | MALICIOUS |
| ESET-NOD32 | WinGo/Filecoder.Gentlemen.B trojan |
| Elastic | malicious (high confidence) |
| Emsisoft | Generic.Ransom.Gentlemen.A.CF8D32C8 (B) |
| F-Secure | Trojan.TR/W64.MalwareX |
| Fortinet | W64/BlackByte.A!tr.ransom |
| GData | Generic.Ransom.Gentlemen.A.CF8D32C8 |
| Detected | |
| Ikarus | Trojan.WinGo.Reverseshell |
| K7AntiVirus | Ransomware ( 006dbb741 ) |
| K7GW | Ransomware ( 006dbb741 ) |
| Kaspersky | HEUR:Trojan-Ransom.Win64.Generic |
| Kingsoft | Win64.Trojan-Ransom.Generic.a |
| Lionic | Trojan.Win32.Gentlemen.j!c |
| Malwarebytes | Malware.AI.1938690323 |
| MaxSecure | Trojan.Malware.638956726.susgen |
| McAfeeD | ti!B67958AFC982 |
| MicroWorld-eScan | Generic.Ransom.Gentlemen.A.CF8D32C8 |
| Microsoft | Ransom:Win64/BlackByte.SZ!MTB |
| Paloalto | generic.ml |
| Panda | Trj/CI.A |
| Rising | Ransom.Gentlemen!8.1D6F3 (CLOUD) |
| Sangfor | HackTool.Win64.PsExec.uwccg |
| SentinelOne | Static AI - Suspicious PE |
| Skyhigh | BehavesLike.Win64.Trojan.wh |
| Sophos | Troj/Gentlem-A |
| Symantec | Trojan Horse |
| Tencent | Malware.Win32.Gencirc.11e58573 |
| TrellixENS | Artemis!3B46A729DB7A |
| TrendMicro | Ransom.Win64.GENTLEMAN.SMPI.go |
| TrendMicro-HouseCall | Ransom.Win64.GENTLEMAN.SMPI.go |
| VIPRE | Generic.Ransom.Gentlemen.A.CF8D32C8 |
| Varist | W64/Filecoder.NH.gen!Eldorado |
| ViRobot | Trojan.Win.C.Ransom.3975680 |
| Zillya | Trojan.Filecoder.Win32.45479 |
| ZoneAlarm | Troj/Gentlem-A |
| alibabacloud | Ransomware:Multi/BlackByte.SO8PHU |
| huorong | Ransom/Filecoder.cv |