Classification: Malicious
tmp7oi279y6 is a trojan (Windows executable, 447.8 KB). Detected by 58 antivirus engines. Linked to Zirconium activity. 19 sightings, last seen 2026-08-26.
Detection summary
- 58 antivirus detections
- 0 IDS alerts
- 5 processes observed
- 0 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Cyber Threat Alliance |
2026-08-26 10:10:37 |
2026-08-26 10:10:37 |
malicious-activity
|
|
| APT31 |
MalwarePatrol |
2026-03-03 17:55:05 |
2026-03-03 18:09:32 |
malicious-activity
|
G0128 ZIRCONIUM
|
| Generic Malware |
Hybrid-Analysis |
2024-09-13 05:45:02 |
2024-09-13 07:15:08 |
|
|
Tags
apt31
judgment panda
red keres
bronze vinewood
zirconium
Sample information
- Filenames
- tmp7oi279y6
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 458504 bytes
- MD5
c8498405ab7a73429e2a49f58c861a68- SHA-1
ad207f5c379fbaf05a2a02e67c2a506dd5bffc89- SHA-256
bd3be94afa57936741a5debde1eff537dcd7c7bc79ccfa9739c4614efc424eeb- First indexed
- 2024-09-13 05:34:32
- Last updated
- 2026-07-30 14:46:07
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Gen:Trojan.Heur2.RP.BqX@bWlOnOhb |
| AVG | Win32:Malware-gen |
| Alibaba | Backdoor:Win32/PcClient.511d6143 |
| Arcabit | Trojan.Heur2.RP.E255C3 |
| Avast | Win32:Malware-gen |
| Avira | TR/Spy.Agent.dneku |
| BitDefender | Gen:Trojan.Heur2.RP.BqX@bWlOnOhb |
| BitDefenderTheta | AI:Packer.2AEE2E2A20 |
| Bkav | W32.AIDetectMalware |
| ClamAV | Win.Trojan.Pcclient-4244 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.5ab7a7 |
| Cylance | Unsafe |
| Cynet | Malicious (score: 99) |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.MulDrop5.56461 |
| ESET-NOD32 | multiple detections |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Trojan.Heur2.RP.BqX@bWlOnOhb (B) |
| F-Secure | Trojan.TR/Spy.Agent.dneku |
| FireEye | Generic.mg.c8498405ab7a7342 |
| Fortinet | W32/Agent.OQNN!tr |
| GData | Gen:Trojan.Heur2.RP.BqX@bWlOnOhb |
| Google | Detected |
| Ikarus | Backdoor.Win32.SuspectCRC |
| Jiangmin | TrojanDropper.Agent.bvif |
| K7AntiVirus | Spyware ( 004c501b1 ) |
| K7GW | Spyware ( 004c501b1 ) |
| Kaspersky | Exploit.Win32.BypassUAC.mj |
| Kingsoft | malware.kb.a.986 |
| Lionic | Trojan.Win32.PcClient.3!c |
| MAX | malware (ai score=85) |
| Malwarebytes | Generic.Malware/Suspicious |
| MaxSecure | Trojan.Malware.10212380.susgen |
| McAfee | Dropper-FOK!C8498405AB7A |
| McAfeeD | ti!BD3BE94AFA57 |
| MicroWorld-eScan | Gen:Trojan.Heur2.RP.BqX@bWlOnOhb |
| Microsoft | TrojanDropper:Win32/Warood.A |
| NANO-Antivirus | Trojan.Win32.Agent.dstgaz |
| Paloalto | generic.ml |
| Panda | Trj/CI.A |
| Rising | Dropper.Warood!8.538A (TFE:5:uLqMVihzRLR) |
| Sangfor | Dropper.Win32.Warood.Vwup |
| Skyhigh | Dropper-FOK!C8498405AB7A |
| Sophos | Mal/Generic-R |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.11521e07 |
| Trapmine | malicious.moderate.ml.score |
| TrendMicro | TROJ_GEN.R034E03IG15 |
| TrendMicro-HouseCall | TROJ_GEN.R034E03IG15 |
| VBA32 | Backdoor.PcClient |
| VIPRE | Gen:Trojan.Heur2.RP.BqX@bWlOnOhb |
| Varist | W32/ABRisk.VACC-0089 |
| Webroot | W32.Trojan.Rawdoor |
| Xcitium | Malware@#1ulkrj0xdhojo |
| Yandex | TrojanSpy.Agent!6f88JtGwOW8 |
| Zillya | Trojan.AgentCRTD.Win32.7787 |
| ZoneAlarm | Exploit.Win32.BypassUAC.mj |
Process list
| Name | Command line |
|---|
| tmp7oi279y6.exe | |
| tmp7oi279y6.exe | |
| tmp7oi279y6.exe | |
| tmp7oi279y6.exe | |
| tmp7oi279y6.exe | |