Classification: Malicious
04074299.exe is a trojan (Windows executable, 558.0 KB). Flagged by 80% of antivirus engines (75 detections). Linked to Apt37 activity.
Detection summary
- 75 antivirus detections (80% detection ratio)
- 1 IDS alerts
- 3 processes observed
- 3 contacted hosts
- 3 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Apt37 |
Maltiverse |
2023-07-04 04:28:51 |
2023-07-05 20:50:55 |
malicious-activity
|
G0067 APT37
|
| Generic Malware |
Hybrid-Analysis |
2023-06-01 15:15:03 |
2023-06-01 15:15:03 |
|
|
Tags
apt
evasive
infostealer
windows-server-utility
Sample information
- Filenames
- 04074299.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 571392 bytes
- MD5
e91cc2e537362de1efdbcfd78cc6c662- SHA-1
0537b130c780406acbb7ecfc85ce103f944f41c7- SHA-256
d7c08a686196d6c28d4f79588aec7a0ca0123e35c57a9b1362e9ac0e381c176b- First indexed
- 2023-06-01 14:55:48
- Last updated
- 2025-11-24 00:10:45
Antivirus detections
| Engine | Detection |
|---|
| Bkav | W32.AIDetectMalware |
| Lionic | Trojan.Win32.Jimmy.4!c |
| DrWeb | Trojan.DownLoader27.65365 |
| MicroWorld-eScan | Trojan.Brsecmon.1 |
| ClamAV | Win.Packed.Ulise-7171866-1 |
| FireEye | Generic.mg.e91cc2e537362de1 |
| McAfee | Sodinokibi!E91CC2E53736 |
| Cylance | unsafe |
| VIPRE | Trojan.Brsecmon.1 |
| Sangfor | Trojan.Win32.Save.a |
| K7AntiVirus | Trojan ( 0054d4121 ) |
| Alibaba | TrojanBanker:Win32/Jimmy.bcc6802c |
| K7GW | Trojan ( 0054d4121 ) |
| Cybereason | malicious.537362 |
| BitDefenderTheta | Gen:NN.ZexaF.36250.Iu0@aO10pY |
| VirIT | Trojan.Win32.Dnldr27.DSSB |
| Symantec | Packed.Generic.525 |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | a variant of Win32/Kryptik.GSTN |
| APEX | Malicious |
| Cynet | Malicious (score: 100) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| BitDefender | Trojan.Brsecmon.1 |
| NANO-Antivirus | Trojan.Win32.Jimmy.fpuhvn |
| Avast | Win32:Malware-gen |
| Tencent | Win32.Trojan.Generic.Ximw |
| Emsisoft | Trojan.Brsecmon.1 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1312568 |
| Zillya | Trojan.Kryptik.Win32.4166994 |
| TrendMicro | Trojan.Win32.SODINOK.SM.hp |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.hh |
| Sophos | Mal/Generic-S |
| SentinelOne | Static AI - Suspicious PE |
| GData | Trojan.Brsecmon.1 |
| Avira | HEUR/AGEN.1312568 |
| Antiy-AVL | Trojan[Banker]/Win32.Jimmy |
| Xcitium | Malware@#3aez9sdy2lx8t |
| Arcabit | Trojan.Brsecmon.1 |
| ViRobot | Trojan.Win32.Z.Ulise.571392.D |
| ZoneAlarm | HEUR:Trojan.Win32.Generic |
| Microsoft | Trojan:Win32/Malgent.B |
| Google | Detected |
| AhnLab-V3 | Malware/Win32.RL_Generic.R268756 |
| VBA32 | Trojan.Fuerboos |
| ALYac | Trojan.Brsecmon.1 |
| MAX | malware (ai score=84) |
| Malwarebytes | Malware.AI.4274955786 |
| Panda | Trj/GdSda.A |
| TrendMicro-HouseCall | Trojan.Win32.SODINOK.SM.hp |
| Rising | Trojan.Kryptik!1.B821 (CLASSIC) |
| Yandex | Trojan.PWS.Jimmy!pcTH6btq9Uw |
| Ikarus | Trojan.Win32.Crypt |
| MaxSecure | Ransomeware.CRAB.gen |
| Fortinet | W32/GenKryptik.DQHN!tr |
| AVG | Win32:Malware-gen |
| DeepInstinct | MALICIOUS |
| CrowdStrike | win/malicious_confidence_100% (W) |
| AVG | FileRepMalware [Pws] |
| Avast | FileRepMalware [Pws] |
| Avira | HEUR/AGEN.1374674 |
| CTX | exe.trojan.generic |
| Cylance | Unsafe |
| Cynet | Malicious (score: 99) |
| F-Secure | Heuristic.HEUR/AGEN.1374674 |
| Kingsoft | Win32.Troj.Agent.cks |
| Lionic | Trojan.Win32.Brsecmon.4!c |
| McAfeeD | Real Protect-LS!E91CC2E53736 |
| Paloalto | generic.ml |
| Skyhigh | BehavesLike.Win32.MultiPlug.hh |
| Tencent | Malware.Win32.Gencirc.144103d9 |
| TrellixENS | Sodinokibi!E91CC2E53736 |
| Varist | W32/ABRisk.SRCW-6750 |
| Webroot | W32.Trojan.Gen |
| alibabacloud | Trojan:Win/Malgent.B |
| huorong | HEUR:VirTool/VCObfuscator.gen!C |
Process list
| Name | Command line |
|---|
| 04074299.exe | |
| cmd.exe | /c taskkill /im 04074299.exe /f & erase C:\04074299.exe & exit |
| taskkill.exe | taskkill /im 04074299.exe /f |