Classification: Malicious
SİPARİS_0433.exe is a trojan (Windows executable, 563.2 KB). Detected by 60 antivirus engines. Linked to Guloader, Ecipekac malware.
Detection summary
- 60 antivirus detections
- 0 IDS alerts
- 3 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| SigLoader |
ThreatFox Abuse.ch |
2024-04-16 16:18:41 |
2024-04-18 16:23:23 |
|
S0624 Ecipekac
|
| Generic Malware |
Hybrid-Analysis |
2024-04-16 16:00:04 |
2024-04-16 16:32:12 |
|
|
| GuLoader |
MalwareBazaar Abuse.ch |
2024-04-16 15:31:18 |
2024-04-16 15:31:18 |
malicious-activity
|
S0561 GuLoader
|
Tags
evasive
windows-server-utility
win.sigloader
Sample information
- Filenames
- SİPARİS_0433.exe, SÄ°PARÄ°S_0433.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows, ...
- Size
- 576696 bytes
- MD5
0e23cf5a43e4ead0716c393318ebc8a2- SHA-1
b11f01415371ccc25ce9ca585fd927350809fc11- SHA-256
e0f85d079be2aa4c24f9a6ffc7af8e9737e0a13a6991af95b887bbaf3f59f83d- First indexed
- 2024-04-16 15:41:05
- Last updated
- 2026-09-24 08:44:51
Antivirus detections
| Engine | Detection |
|---|
| AVG | NSIS:Malware-gen [Trj] |
| Avast | NSIS:Malware-gen [Trj] |
| Bkav | W32.AIDetectMalware |
| CrowdStrike | win/malicious_confidence_60% (D) |
| ESET-NOD32 | NSIS/Injector.ASH |
| Elastic | malicious (high confidence) |
| Fortinet | NSIS/Injector.P6X!tr |
| Ikarus | Trojan.NSIS.Agent |
| Kaspersky | UDS:Backdoor.Win32.Androm.gen |
| Kingsoft | malware.kb.a.915 |
| McAfee | PS/GuLoader.a |
| Microsoft | Trojan:Win32/Sonbokli.A!cl |
| Skyhigh | PS/GuLoader.a |
| TrendMicro-HouseCall | TROJ_GEN.R06CH06DG24 |
| ZoneAlarm | UDS:Backdoor.Win32.Androm.gen |
| ALYac | Trojan.GenericKD.72397280 |
| AhnLab-V3 | Downloader/Win.GuLoader.R645721 |
| Alibaba | Backdoor:Win32/Androm.4ae33a38 |
| Antiy-AVL | Trojan[Backdoor]/Win32.Androm.gen |
| Arcabit | Trojan.Generic.D450B1E0 |
| Avira | TR/AVI.Agent.feihu |
| BitDefender | Trojan.GenericKD.72397280 |
| Bkav | W32.Common.686D85A2 |
| CAT-QuickHeal | Trojan.Ghanarava.1733913407ebc8a2 |
| CTX | exe.trojan.guloader |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 99) |
| DeepInstinct | MALICIOUS |
| Emsisoft | Trojan.GenericKD.72397280 (B) |
| F-Secure | Trojan.TR/AVI.Agent.feihu |
| FireEye | Trojan.GenericKD.72397280 |
| GData | Trojan.GenericKD.72397280 |
| Google | Detected |
| Gridinsoft | Trojan.Win32.Downloader.dd!n |
| Ikarus | Trojan.PowerShell.GuLoader |
| K7AntiVirus | Trojan ( 005903451 ) |
| K7GW | Trojan ( 005903451 ) |
| Kaspersky | HEUR:Backdoor.Win32.Androm.gen |
| Lionic | Trojan.Win32.GuLoader.m!c |
| Malwarebytes | Neshta.Virus.FileInfector.DDS |
| MaxSecure | Trojan.Malware.317736752.susgen |
| McAfee | Artemis!0E23CF5A43E4 |
| McAfeeD | ti!E0F85D079BE2 |
| MicroWorld-eScan | Trojan.GenericKD.72397280 |
| Microsoft | Trojan:Win32/GuLoader.KMNC!MTB |
| Paloalto | generic.ml |
| Panda | Trj/Chgt.AD |
| Sangfor | Backdoor.Win32.Injector.V3qi |
| Sophos | Mal/Generic-S |
| Symantec | Trojan.Gen.MBT |
| Tencent | Win32.Trojan.FalseSign.Msmw |
| TrendMicro | TROJ_GEN.R002C0DKQ24 |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DKQ24 |
| VBA32 | Trojan.Win32.SCTemp.Heur |
| VIPRE | Trojan.GenericKD.72397280 |
| Varist | W32/Injector.IQXV-1196 |
| VirIT | Trojan.Win32.NSISDrp.GNW |
| alibabacloud | Backdoor:Win/GuLoader.RX8PHU |
| huorong | Trojan/Injector.blj |
Process list
| Name | Command line |
|---|
| S_PAR_S_0433.exe | |
| powershell.exe | -windowstyle hidden "$trunnions=Get-Content '%TEMP%\sammentrkkenes\petrochemical\pakken\Emptores.Ala209';$Facelessnesses=$trunnions.SubString(73916,3);.$Facelessnesses($trunnions)" |
| cmd.exe | /c "set /A 1^^0" |