Classification: Malicious
LaZagne.exe is a hacktool (Windows 64-bit executable, 9.7 MB). Detected by 48 antivirus engines. Linked to Lazagne malware. 9 sightings, last seen 2026-09-08.
Detection summary
- 48 antivirus detections
- 0 IDS alerts
- 9 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Lazagne |
Triage |
2026-03-03 08:00:52 |
2026-09-08 15:04:45 |
malicious-activity
|
S0349 LaZagne
|
| Generic Malware |
Triage |
2026-02-17 12:05:23 |
2026-02-17 12:05:23 |
malicious-activity
|
|
| Lazagne |
MalwareBazaar Abuse.ch |
2026-02-17 12:05:08 |
2026-02-17 12:05:08 |
malicious-activity
|
S0349 LaZagne
|
| Generic Malware |
Hybrid-Analysis |
2025-05-21 07:29:55 |
2025-05-21 08:30:16 |
|
|
Tags
collection
credential_access
pyinstaller
spyware
stealer
lazagne
execution
hacktool
discovery
persistence
Sample information
- Filenames
- LaZagne.exe, LaZane.exe, dc06d62ee95062e714f2566c95b8edaabfd387023b1bf98a09078b84007d5268, 2.exe, LaZagne_2.exe
- File type
- PE32+ executable (console) x86-64, for MS Windows, ...
- Size
- 10136093 bytes
- MD5
81448745b5d62608b37888b38e9f276a- SHA-1
3197ad76e27ca63e6de1b255f7c0196ea7670bf8- SHA-256
dc06d62ee95062e714f2566c95b8edaabfd387023b1bf98a09078b84007d5268- SHA-512
76404c29eeddcef4121b19d7977c81b96aab54dc20680391b0e7fb59ee5fedfc590374f48c02194fd3df304428e6998177714e3894ee844a38cba72c7284d8e2- First indexed
- 2025-05-21 07:22:46
- Last updated
- 2026-09-08 15:58:14
Antivirus detections
| Engine | Detection |
|---|
| APEX | Malicious |
| AVG | Win32:LaZagne-B [PUP] |
| Alibaba | HackTool:Win32/Almi_LaZagne.b |
| Arcabit | Trojan.Clyp.11 |
| Avast | Win32:LaZagne-B [PUP] |
| BitDefender | Gen:Heur.Clyp.11 |
| CAT-QuickHeal | Hacktool.Lazagne |
| CTX | exe.trojan.lazagne |
| ClamAV | Win.Trojan.Lazagne-6779429-0 |
| CrowdStrike | win/malicious_confidence_90% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Tool.LaZagne.18 |
| ESET-NOD32 | multiple detections |
| Emsisoft | Gen:Heur.Clyp.11 (B) |
| Fortinet | Riskware/LaZagne |
| GData | Gen:Heur.Clyp.11 |
| Google | Detected |
| Gridinsoft | Hack.Win64.Patcher.sa |
| K7AntiVirus | Trojan ( 0057d8c51 ) |
| K7GW | Trojan ( 0057d8c51 ) |
| Kaspersky | Trojan-PSW.Win32.Stealer.couz |
| Lionic | Trojan.Win32.LaZagne.i!c |
| Malwarebytes | RiskWare.LaZagne |
| MaxSecure | Trojan.Malware.326153580.susgen |
| McAfee | Artemis!81448745B5D6 |
| McAfeeD | ti!DC06D62EE950 |
| MicroWorld-eScan | Gen:Heur.Clyp.11 |
| Microsoft | VirTool:Win32/Lazagne |
| NANO-Antivirus | Trojan.Win64.Stealer.kxdlrf |
| Paloalto | generic.ml |
| Panda | Trj/Agent.MDNZ |
| Rising | HackTool.Lazagne/PYC!1.100FF (CLASSIC) |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win64.Dropper.tc |
| Sophos | ATK/LaZagne-N |
| Symantec | Hacktool.LaZagne |
| Tencent | Win32.Trojan-QQPass.QQRob.Hmnw |
| TrendMicro | HackTool.Win64.LaZagne.SM |
| TrendMicro-HouseCall | HackTool.Win64.LaZagne.SM |
| VBA32 | TrojanPSW.Stealer |
| VIPRE | Gen:Heur.Clyp.11 |
| Varist | W64/ABApplication.SMXT-3970 |
| Webroot | Win.Hacktool.Lazagne |
| Zillya | Trojan.Agent.Win32.3962631 |
| ZoneAlarm | ATK/LaZagne-N |
| alibabacloud | Hacktool:Python/laZagne |
| huorong | HackTool/Python.LaZagne.c |
Process list
| Name | Command line |
|---|
| LaZagne_2.exe | |
| LaZagne_2.exe | |
| cmd.exe | /c "ver" |
| cmd.exe | /c "reg.exe save hklm\sam %TEMP%\ndiuvs" |
| reg.exe | save hklm\sam %TEMP%\ndiuvs |
| cmd.exe | /c "reg.exe save hklm\security %TEMP%\aldblvleg" |
| reg.exe | save hklm\security %TEMP%\aldblvleg |
| cmd.exe | /c "reg.exe save hklm\system %TEMP%\xxrauk" |
| reg.exe | save hklm\system %TEMP%\xxrauk |