bd8669b5ad88a654a65db9579da4f2990d725261bee958ec0c7d6db3f112e170c50ea5541a81b5f1c3ff48419dfe50fc644d4da5b8d3b74983a8e16d8acb9553
Classification: Malicious
bd8669b5ad88a654a65db9579da4f2990d725261bee958ec0c7d6db3f112e170c50ea5541a81b5f1c3ff48419dfe50fc644d4da5b8d3b74983a8e16d8acb9553 is a malicious file sample.
Detection summary
- 81 antivirus detections (75% detection ratio)
- 0 IDS alerts
- 5 processes observed
- 1 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Hybrid-Analysis |
2023-05-05 11:15:03 |
2023-05-05 11:15:03 |
|
|
| Ta505 |
Maltiverse |
2023-04-27 04:33:51 |
2023-04-28 14:38:31 |
malicious-activity
|
G0092 TA505
|
Tags
evasive
locky
ransomware
windows-server-utility
apt
Sample information
- Filenames
- bd8669b5ad88a654a65db9579da4f2990d725261bee958ec0c7d6db3f112e170c50ea5541a81b5f1c3ff48419dfe50fc644d4da5b8d3b74983a8e16d8acb9553
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 95744 bytes
- MD5
f05dbb721b31f12466b6114adc2fce39- SHA-1
ff7bb5b04b87c1e4b0f9eaf7988fd92d84e25c6b- SHA-256
e4ea88887753a936eaf3361dcc00380b88b0c210dcbde24f8f7ce27991856bf6- First indexed
- 2023-04-28 14:38:31
- Last updated
- 2025-10-18 08:34:21
Antivirus detections
| Engine | Detection |
|---|
| Bkav | W32.AIDetectMalware |
| Lionic | Trojan.Win32.DarkVNC.4!c |
| Cynet | Malicious (score: 100) |
| ALYac | Gen:Variant.Lazy.271868 |
| Cylance | unsafe |
| Sangfor | Backdoor.Win32.Darkvnc.V9g9 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Alibaba | Backdoor:Win32/DarkVNC.1c4fd3ec |
| K7GW | Riskware ( 0040eff71 ) |
| K7AntiVirus | Riskware ( 0040eff71 ) |
| Cyren | W32/ABRisk.IQSN-3789 |
| Symantec | Trojan Horse |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | a variant of Win32/Agent.AEYE |
| APEX | Malicious |
| Paloalto | generic.ml |
| Kaspersky | Backdoor.Win32.DarkVNC.rr |
| BitDefender | Gen:Variant.Lazy.271868 |
| MicroWorld-eScan | Gen:Variant.Lazy.271868 |
| Avast | Win32:BackdoorX-gen [Trj] |
| Rising | Trojan.Agent!8.B1E (TFE:3:lVmKEGZ4QoP) |
| Emsisoft | Gen:Variant.Lazy.271868 (B) |
| F-Secure | Trojan.TR/Crypt.XPACK.Gen3 |
| DrWeb | Trojan.MulDrop21.47483 |
| VIPRE | Gen:Variant.Lazy.271868 |
| TrendMicro | TROJ_GEN.R002C0DC723 |
| McAfee-GW-Edition | BehavesLike.Win32.Dropper.nh |
| Trapmine | suspicious.low.ml.score |
| FireEye | Gen:Variant.Lazy.271868 |
| Sophos | Troj/Lobshot-B |
| Ikarus | Trojan.Win32.Agent |
| Avira | TR/Crypt.XPACK.Gen3 |
| MAX | malware (ai score=89) |
| Antiy-AVL | Trojan[Backdoor]/Win32.Darkvnc |
| Microsoft | Trojan:Win32/Sdaloog.C |
| Arcabit | Trojan.Lazy.D425FC |
| ZoneAlarm | Backdoor.Win32.DarkVNC.rr |
| GData | Gen:Variant.Lazy.271868 |
| Google | Detected |
| AhnLab-V3 | Trojan/Win.Generic.R561137 |
| McAfee | Artemis!F05DBB721B31 |
| VBA32 | BScope.Backdoor.DarkVNC |
| Malwarebytes | Trojan.MalPack.RV.Generic |
| Panda | Trj/Chgt.AD |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DC723 |
| Tencent | Win32.Backdoor.Darkvnc.Qsmw |
| Yandex | Trojan.Agent!7HHH2bTalAA |
| MaxSecure | Trojan.Malware.202475856.susgen |
| Fortinet | W32/Agent.AEYE!tr |
| BitDefenderTheta | Gen:NN.ZexaF.36164.fu0@a8cndBei |
| AVG | Win32:BackdoorX-gen [Trj] |
| DeepInstinct | MALICIOUS |
| ALYac | Backdoor.DarkVNC.Gen |
| AVG | Win32:MalwareX-gen [Bd] |
| Alibaba | Backdoor:Win32/Sdaloog.be7e1025 |
| Avast | Win32:MalwareX-gen [Bd] |
| CAT-QuickHeal | Trojan.Ghanarava.17339121132fce39 |
| CTX | exe.trojan.darkvnc |
| Cylance | Unsafe |
| Elastic | Windows.Trojan.Lobshot |
| Jiangmin | Backdoor.DarkVNC.dq |
| Kingsoft | Win32.Hack.DarkVNC.gen |
| Lionic | Trojan.Win32.DarkVNC.m!c |
| Malwarebytes | Generic.Malware.AI.DDS |
| McAfeeD | ti!E4EA88887753 |
| Microsoft | Trojan:Win32/Sdaloog!pz |
| Sangfor | Backdoor.Win32.Sdaloog.V1dd |
| Skyhigh | GenericRXVX-DB!F05DBB721B31 |
| TACHYON | Trojan/W32.Lobshot.95744 |
| Tencent | Malware.Win32.Gencirc.13af1515 |
| TrellixENS | GenericRXVX-DB!F05DBB721B31 |
| TrendMicro | TROJ_GEN.R002C0DFA25 |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DFA25 |
| Varist | W32/ABRisk.IQSN-3789 |
| VirIT | Trojan.Win32.Genus.QLF |
| Webroot | W32.Trojan.Gen |
| Xcitium | Malware@#30963z2sy2g64 |
| Zillya | Trojan.Agent.Win32.3404878 |
| ZoneAlarm | Troj/Lobshot-B |
| alibabacloud | Backdoor:Win/DarkVNC.gyf |
| huorong | Trojan/Agent.bdx |
Process list
| Name | Command line |
|---|
| bd8669b5ad88a654a65db9579da4f2990d725261bee958ec0c7d6db3f112e170c50ea5541a81b5f1c3ff48419dfe50fc644d4da5b8d3b74983a8e16d8acb9553.exe | |
| cmd.exe | /c (ping -n 10 127.0.0.1) & (del /F /Q "C:\bd8669b5ad88a654a65db9579da4f2990d725261bee958ec0c7d6db3f112e170c50ea5541a81b5f1c3ff48419dfe50fc644d4da5b8d3b74983a8e16d8acb9553.exe") & (start "" "%ALLUSERSPROFILE%\c0807493.exe") |
| PING.EXE | ping -n 10 127.0.0.1 |
| c0807493.exe | |
| explorer.exe | %ALLUSERSPROFILE%\c0807493.exe |