d628dd1d65514247d90cd78e0f8a730e2d7fe9a1506b3bdca3ebcc74a6c657a1.exe

Classification: Malicious

d628dd1d65514247d90cd78e0f8a730e2d7fe9a1506b3bdca3ebcc74a6c657a1.exe is a malicious file sample. Reported by 1 threat source, last seen 2020-09-30.

Detection summary

  • 102 antivirus detections (80% detection ratio)
  • 1 IDS alerts
  • 4 processes observed
  • 1 contacted hosts
  • 1 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Trojan.Dropper Hybrid-Analysis 2020-09-30 12:00:14 2020-09-30 12:00:14

Tags

banker emotet hyteod infostealer installcore pua pup qakbot ransomware

Sample information

Filenames
d628dd1d65514247d90cd78e0f8a730e2d7fe9a1506b3bdca3ebcc74a6c657a1.exe
File type
PE32 executable (GUI) Intel 80386 (stripped to ext ...
Size
140800 bytes
MD5
02d9d09943945f491634a15f14ba4ab6
SHA-1
298d4ae6c6bd7d0ba6ee7ba17280ab243124a6fe
SHA-256
d628dd1d65514247d90cd78e0f8a730e2d7fe9a1506b3bdca3ebcc74a6c657a1
First indexed
2020-09-30 12:00:14
Last updated
2026-09-03 00:00:38

Antivirus detections

EngineDetection
BkavW32.AIDetectVM.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.Dropper.SAG
McAfeeArtemis!02D9D0994394
CylanceUnsafe
ZillyaTrojan.Refroso.Win32.47268
SangforMalware
K7AntiVirusTrojan ( 0055e3f01 )
AlibabaBackdoor:Win32/Bifrose.9427bf5c
K7GWTrojan ( 0055e3f01 )
Cybereasonmalicious.943945
InvinceaMal/Generic-S (PUA)
CyrenW32/Patched.E.gen!Eldorado
SymantecBackdoor.Bifrose
ESET-NOD32Win32/Bifrose.NTA
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Trojan.Bifrose-9762706-0
KasperskyTrojan.Win32.Refroso.cyyn
BitDefenderTrojan.Dropper.SAG
NANO-AntivirusVirus.Win32.Gen-Crypt.ccnc
AvastWin32:Evo-gen [Susp]
TencentWin32.Trojan.Refroso.bcb
Ad-AwareTrojan.Dropper.SAG
SophosMal/Generic-S
ComodoApplication.Win32.PkdVilsel.A@1ulmqd
F-SecureTrojan.TR/Crypt.XPACK.Gen
DrWebBackDoor.Bifrost.19762
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionBehavesLike.Win32.Virut.cc
FireEyeGeneric.mg.02d9d09943945f49
EmsisoftTrojan.Dropper.SAG (B)
JiangminTrojan/Refroso.aakb
WebrootW32.Trojan.Gen
AviraTR/Crypt.XPACK.Gen
MicrosoftBackdoor:Win32/Bifrose.HZ
ArcabitTrojan.Dropper.SAG
AegisLabTrojan.Win32.Generic.lAJh
ZoneAlarmTrojan.Win32.Refroso.cyyn
GDataTrojan.Dropper.SAG
CynetMalicious (score: 100)
Acronissuspicious
VBA32Trojan.Inject
ALYacTrojan.Dropper.SAG
MAXmalware (ai score=99)
RisingBackdoor.Bifrose!8.B24 (TFE:4:Z6NxTvPx4jJ)
YandexTrojan.Refroso!lzl96aXe8dc
IkarusTrojan-Clicker.Win32.VBiframe
eGambitUnsafe.AI_Score_100%
FortinetW32/Graftor.SETW!tr
BitDefenderThetaAI:Packer.D8B4FF5721
AVGWin32:Evo-gen [Susp]
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Win32/Trojan.269
ALYacBackdoor.Bifrose
AVGWin32:Evo-gen [Trj]
AvastWin32:Evo-gen [Trj]
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.Ghanarava.1732832840ba4ab6
CTXexe.trojan.bifrose
DeepInstinctMALICIOUS
GoogleDetected
GridinsoftPack.Win32.Gen.bot!ep-45894
IkarusBackdoor.Win32.Hupigon
KasperskyBackdoor.Win32.Bifrose.ggih
Kingsoftmalware.kb.a.1000
LionicTrojan.Win32.Generic.lAJh
MalwarebytesMalware.AI.2970705039
MaxSecureTrojan.Malware.1752242.susgen
McAfeeDti!D628DD1D6551
MicrosoftBackdoor:Win32/Bifrose
PandaTrj/Genetic.gen
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.RisePro.cc
TencentMalware.Win32.Gencirc.115d2fcf
Trapminemalicious.high.ml.score
TrellixENSGenericRXAA-AA!02D9D0994394
TrendMicroTrojanSpy.Win32.BIFROSE.USMANJA20
TrendMicro-HouseCallTrojanSpy.Win32.BIFROSE.USMANJA20
VBA32Trojan.Packed
VIPRETrojan.Dropper.SAG
VaristW32/Patched.E.gen!Eldorado
XcitiumApplication.Win32.PkdVilsel.A@1ulmqd
ZonerProbably Heur.ExeHeaderL
alibabacloudBackdoor:Win/Bifrose.NSZ
huorongBackdoor/Bifrose.x
ArcabitBackdoor.Bifrose.ZXE
BitDefenderBackdoor.Bifrose.ZXE
BkavW32.Malware.BF155C08
ESET-NOD32Win32/Bifrose.NTA trojan
EmsisoftBackdoor.Bifrose.ZXE (B)
GDataBackdoor.Bifrose.ZXE
K7AntiVirusBackdoor ( 00000a8c1 )
K7GWBackdoor ( 00000a8c1 )
KingsoftWin32.HeurC.KVMH008.a
MalwarebytesMalware.AI.4013153467
MicroWorld-eScanBackdoor.Bifrose.ZXE
MicrosoftBackdoor:Win32/Bifrose!rfn
SkyhighBehavesLike.Win32.Dropper.cc
VIPREBackdoor.Bifrose.ZXE

Network contacts

255.255.255.255

DNS requests

d5nd.zapto.org

Process list

NameCommand line
d628dd1d65514247d90cd78e0f8a730e2d7fe9a1506b3bdca3ebcc74a6c657a1.exe
server.exe
explorer.exe
iexplore.exe