VencordInstaller.exe

Classification: Malicious

VencordInstaller.exe is a malicious file sample (Windows 64-bit executable, 9.9 MB). Detected by 3 antivirus engines. Linked to Mimikatz malware.

Detection summary

  • 3 antivirus detections
  • 0 IDS alerts
  • 2 processes observed
  • 2 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Malware families: MIMIKATZ (S0002)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Suspicious Sample Triage 2026-08-02 17:10:37 2026-10-06 18:15:36 anomalous-activity
Generic Malware Triage 2026-02-05 17:13:40 2026-07-29 22:24:13 malicious-activity
Quasar Triage 2026-07-17 20:55:39 2026-07-17 20:55:39 malicious-activity
Salatstealer Triage 2026-02-27 20:43:14 2026-02-27 20:43:14 malicious-activity
Generic Malware Hybrid-Analysis 2024-01-24 18:15:11 2025-07-02 18:15:21
MimiKatz ThreatFox Abuse.ch 2025-03-17 17:38:01 2025-03-19 17:24:12 S0002 Mimikatz
Generic.Malware MalwareBazaar Abuse.ch 2024-11-19 07:36:35 2024-11-19 07:36:35 malicious-activity

Tags

evasive win.mimikatz backdoor botnet downloader dropper exploit installcore mirai onelouder pua pup ransomware spambot spyware tofsee trojan discovery defense_evasion persistence privilege_escalation stealer adware execution upx salatstealer installer bootkit themida phishing motw quasar ledger live

Sample information

Filenames
VencordInstaller.exe, VencordInstaller (1).exe, VencordInstaller(1).exe, VencordInstaller(2).exe, VencordInstaller (2).exe
File type
PE32+ executable (GUI) x86-64 (stripped to externa ...
Size
10339840 bytes
MD5
1b8ee61ddcfd1d425821d76ea54ca829
SHA-1
f8daf2bea3d4a6bfc99455d69c3754054de3baa5
SHA-256
dc0826657a005009f43bdc3a0933d08352f8b22b2b9b961697a2db6e9913e871
SHA-512
75ba16ddc75564e84f5d248326908065942ad50631ec30d7952069caee15b8c5411a8802d25d38e9d80e042f1dde97a0326f4ab4f1c90f8e4b81396ca69c229a
First indexed
2024-01-24 17:51:16
Last updated
2026-10-06 18:58:48

Antivirus detections

EngineDetection
GoogleDetected
IkarusTrojan.WinGo.Rozena
GridinsoftRansom.Win64.Gen.tr

Network contacts

140.82.112.6 192.30.255.117

DNS requests

api.github.com

Process list

NameCommand line
VencordInstaller.exe
VencordInstaller.exe