ErmWhatsWrongWithMyPC.exe

Classification: Malicious

ErmWhatsWrongWithMyPC.exe is a trojan (Windows executable, 25.2 MB). Detected by 72 antivirus engines. Linked to Chaos malware.

Detection summary

  • 72 antivirus detections
  • 2 IDS alerts
  • 121 processes observed
  • 42 contacted hosts
  • 15 DNS requests

MITRE ATT&CK associations

Malware families: CHAOS (S0220)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Ades_stealer Triage 2026-04-26 00:02:40 2026-09-13 20:44:17 malicious-activity
XWorm MalwareBazaar Abuse.ch 2026-09-04 09:12:05 2026-09-04 09:12:05 malicious-activity
Chaos Triage 2026-04-25 02:58:33 2026-04-25 02:58:33 malicious-activity S0220 Chaos
Generic Malware Hybrid-Analysis 2025-09-13 13:00:04 2026-02-24 04:45:15

Tags

evasive ransomware njrat trojan infostealer chaos cobaltstrike dcrat discordrat dragonforce gcleaner gh0strat lockbit modiloader onlylogger redline rokrat sectoprat umbral valleyrat_s2 vidar vipkeylogger xorist 158fdd2a4f5abb978509580715e5353f 987654321 cheat aspackv2 backdoor defense_evasion discovery execution impact installer keylogger loader persistence rat revoked_codesign rootkit stealer ades_stealer jlocker masslogger raworld xworm spyware hiddentear bootkit revengerat spam

Sample information

Filenames
ErmWhatsWrongWithMyPC.exe
File type
PE32 executable for MS Windows 4.00 (GUI), Intel i ...
Size
26416256 bytes
MD5
cc1de237b93bcbae465f9d3bf4df075a
SHA-1
72967f94fed66473027c9b36a17bb61cf8e22540
SHA-256
c2e9fbca414575d5c080d97f378024a4d131d6e1262112aebaa96eafa3592381
First indexed
2025-09-13 12:29:52
Last updated
2026-10-10 21:10:07

Antivirus detections

EngineDetection
ALYacGen:Variant.Midie.165163
APEXMalicious
AVGWin32:Evo-gen [Trj]
AhnLab-V3Dropper/Win.Generic.C5769159
Antiy-AVLTrojan[Dropper]/Win32.Dapato
ArcabitTrojan.Midie.D2852B
AvastWin32:Evo-gen [Trj]
AviraHEUR/AGEN.1375904
BitDefenderGen:Variant.Midie.165163
BkavW32.AIDetectMalware
CTXexe.unknown.midie
CrowdStrikewin/malicious_confidence_100% (D)
CylanceUnsafe
CynetMalicious (score: 99)
DeepInstinctMALICIOUS
ESET-NOD32a variant of Win32/TrojanDropper.Agent.SRP
Elasticmalicious (high confidence)
EmsisoftGen:Variant.Midie.165163 (B)
F-SecureHeuristic.HEUR/AGEN.1375904
FortinetW32/Tiny.NFR!tr
GDataGen:Variant.Midie.165163
GoogleDetected
IkarusTrojan.Win32.Tnega
JiangminTrojan.Generic.hulzb
K7AntiVirusTrojan ( 0059450a1 )
K7GWTrojan ( 0059450a1 )
KasperskyHEUR:Trojan-PSW.MSIL.Reline.gen
MalwarebytesTrojan.Injector
McAfeeDti!C2E9FBCA4145
MicroWorld-eScanGen:Variant.Midie.165163
MicrosoftTrojanDropper:Win32/Dapato!pz
RisingBackdoor.DcRat!8.129D9 (TFE:1:BNER4NzZWDL)
SangforTrojan.Win32.Save.a
SkyhighGenericRXTU-AS!CC1DE237B93B
SophosTroj/Drop-DND
SymantecTrojan Horse
TencentMalware.Win32.Gencirc.147e7ed6
Trapminemalicious.high.ml.score
TrellixENSGenericRXTU-AS!CC1DE237B93B
TrendMicro-HouseCallTrojan.Win32.VSX.PE04C9n
VBA32BScope.Trojan.Nitol
VIPREGen:Variant.Midie.165163
VirITTrojan.Win32.Genus.YBD
ZillyaDropper.Agent.Win32.645941
ZoneAlarmTroj/Drop-DND
huorongTrojanSpy/RedLine.q
ALYacGen:Variant.ClipBanker.569
AVGWin32:MalwareX-gen [Misc]
AlibabaBackdoor:Win32/Jorik.3f3b7729
ArcabitTrojan.ClipBanker.569
AvastWin32:MalwareX-gen [Misc]
AviraTR/W32.Agent
BkavW32.Malware.71B098FD
CTXexe.trojan.generic
CrowdStrikewin/malicious_confidence_100% (W)
DrWebTrojan.MulDrop32.59534
EmsisoftGen:Variant.ClipBanker.569 (B)
F-SecureTrojan.TR/W32.Agent
GDataGen:Variant.ClipBanker.569
GridinsoftMalware.Win32.Gen.tr
K7AntiVirusTrojan ( 005ce6931 )
K7GWTrojan ( 005ce6931 )
LionicTrojan.Win32.Dapato.i!c
MaxSecureTrojan.Malware.73564251.susgen
McAfeeDTrojan:Win/Dropper.AAB
MicroWorld-eScanGen:Variant.ClipBanker.569
Paloaltogeneric.ml
SentinelOneStatic AI - Suspicious PE
VIPREGen:Variant.ClipBanker.569
VaristW32/ABTrojan.VJNJ-8717
alibabacloudTrojan[dropper]:Win/Dapato.Gen
huorongTrojanSpy/MSIL.Stealer.aok!crit

Network contacts

154.91.34.165 192.168.0.0 192.168.0.1 192.168.0.3 192.168.0.4 192.168.0.5 192.168.0.6 192.168.0.7 192.168.0.8 192.168.0.9 192.168.0.10 192.168.0.11 192.168.0.12 192.168.0.13 192.168.0.14 192.168.0.15 192.168.0.16 192.168.0.17 192.168.0.18 192.168.0.19 192.168.0.20 192.168.0.21 192.168.0.22 192.168.0.23 192.168.0.24 192.168.0.25 192.168.0.26 192.168.0.27 192.168.0.28 192.168.0.29 192.168.0.30 192.168.0.31 196.251.66.118 45.141.233.69 149.154.167.99 154.23.184.57 98.177.107.142 162.159.135.234 103.171.35.26 162.159.130.234 142.250.189.227 176.65.144.23

DNS requests

myhost.misecure.com 05242258e8c0ee41b5ec.com 17.aa.4t.com blackswmxc.top cladwybn.digital featurlyin.top gateway.discord.gg jackthyfuc.run laminaflbx.shop narrathfpt.top onehunqpom.life overcovtcg.top posseswsnc.top t.me gstatic.com

Process list

NameCommand line
ErmWhatsWrongWithMyPC.exe
0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe
01ec7b1066df7c55e262dc375bff5fd13a1fc9706c3db4b3522ac8b9d2453b52.exe
1bad2b6e8ab16c5a692b2d05f68f7924a73a5818ddf3a9678ca8caab3568a78e.exe
powershell.exepowershell -Command "& { }"
net.exenet stop "Acronis VSS Provider" /y
net1.exe%WINDIR%\system32\net1 stop "Acronis VSS Provider" /y
net.exenet stop "Enterprise Client Service" /y
net1.exe%WINDIR%\system32\net1 stop "Enterprise Client Service" /y
net.exenet stop "Sophos Agent" /y
net1.exe%WINDIR%\system32\net1 stop "Sophos Agent" /y
net.exenet stop "Sophos AutoUpdate Service" /y
net1.exe%WINDIR%\system32\net1 stop "Sophos AutoUpdate Service" /y
net.exenet stop "Sophos Clean Service" /y
net1.exe%WINDIR%\system32\net1 stop "Sophos Clean Service" /y
net.exenet stop "Sophos Device Control Service" /y
net1.exe%WINDIR%\system32\net1 stop "Sophos Device Control Service" /y
net.exenet stop "Sophos File Scanner Service" /y
5f7dbb2374af6314df4cd22c830ffaced38bc2ea8ec16775e502d7422ca74f35.exe
7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
7a8c864ed8b7ca908d3f317d7e63a30a85fb3e8c94070f23f2cf0bfa01c5e0b5.exe
59ab63c99285e35679153e299e411aa32a94d25482566428a6fd7d908f04d4ad.exe
60e76eda46185d1d2e9463d15e31d4c87eb03535d368cc3471c55992bc99ad5f.exe
77ebb550f38da3f28a65940a4c665ae3a679249ad906aa39387568a1f7ddd3fa.exe
80e3a04fa68be799b3c91737e1918f8394b250603a231a251524244e4d7f77d9.exe
182fb9756b66963f458ebbe0f20ff2715a758825ac6655fc56ec85579df61330.exe
188c3798b6d41bdfa3981bb61a40b81f4fe123c64b9bed2d4c40951de2064f19.exe
WerFault.exe-u -p 5860 -s 600
ErmWhatsWrongWithMyPC.exe
0f78a658b60f0879acccf0933d9ae8a5d2c188e9f16b8e6f7b01bd0cc9b5c4e1.exe