update.bin

Classification: Malicious

update.bin is a ransomware (Windows executable, 3.5 MB). Flagged by 77% of antivirus engines (115 detections). Linked to Uroburos malware.

Detection summary

  • 115 antivirus detections (77% detection ratio)
  • 0 IDS alerts
  • 2 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: UROBUROS (S0022)

Intrusion sets: TURLA (G0010)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2023-03-23 20:30:03 2023-03-23 20:30:03
Snake MalwareBazaar Abuse.ch 2022-04-23 15:33:42 2022-04-23 15:33:42 malicious-activity G0010 Turla S0022 Uroburos
AV.Generic Hybrid-Analysis 2019-12-28 22:00:05 2019-12-28 22:00:05

Sample information

Filenames
e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60, update.bin, e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60_unpacked
File type
PE32 executable (console) Intel 80386 (stripped to ...
Size
3718656 bytes
MD5
3d1cc4ef33bad0e39c757fce317ef82a
SHA-1
f34e4b7080aa2ee5cfee2dac38ec0c306203b4ac
SHA-256
e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60
First indexed
2019-12-28 22:00:05
Last updated
2026-10-10 00:58:48

Antivirus detections

EngineDetection
MicroWorld-eScanGen:Win32.AV-Killer.ItW@aei5Gqj
Qihoo-360Win32/Trojan.07f
McAfeeTrojan-Ransom.b
CylanceUnsafe
SangforMalware
K7AntiVirusRiskware ( 0040eff71 )
K7GWRiskware ( 0040eff71 )
ArcabitGen:Win32.AV-Killer.E64FB6
Invinceaheuristic
CyrenW32/Trojan.AQQM-5188
SymantecML.Attribute.HighConfidence
AvastWin32:Malware-gen
KasperskyTrojan.Win32.Antavmu.asdd
BitDefenderGen:Win32.AV-Killer.ItW@aei5Gqj
Paloaltogeneric.ml
Ad-AwareGen:Win32.AV-Killer.ItW@aei5Gqj
ComodoMalware@#3hlbu4qfgaf2f
F-SecureTrojan.TR/Antavmu.tygqh
TrendMicroRansom.Win32.EKANS.A
McAfee-GW-EditionBehavesLike.Win32.Downloader.wm
FireEyeGen:Win32.AV-Killer.ItW@aei5Gqj
EmsisoftGen:Win32.AV-Killer.ItW@aei5Gqj (B)
AviraTR/Antavmu.tygqh
MicrosoftRansom:Win32/Killpror!MSR
Endgamemalicious (moderate confidence)
ZoneAlarmTrojan.Win32.Antavmu.asdd
GDataGen:Win32.AV-Killer.ItW@aei5Gqj
ALYacGen:Win32.AV-Killer.ItW@aei5Gqj
MAXmalware (ai score=89)
TrendMicro-HouseCallRansom.Win32.EKANS.A
Rising[email protected] (RDMK:Nww4euOpubK84kPB3Wf7fQ)
IkarusGen.Win32.AV-Killer
FortinetW32/AntiAV!tr
BitDefenderThetaGen:NN.ZexaF.33558.ItW@aei5Gqj
AVGWin32:Malware-gen
PandaTrj/CI.A
CrowdStrikewin/malicious_confidence_70% (W)
LionicTrojan.Win32.Antavmu.4!c
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Trojan.AV-Killer.ItW@aei5Gqj
ALYacTrojan.Ransom.Filecoder
VIPRETrojan.Win32.Generic!BT
SangforRansom.Win32.Killpror.MSR
BitDefenderGen:Trojan.AV-Killer.ItW@aei5Gqj
CrowdStrikewin/malicious_confidence_100% (W)
VirITTrojan.Win32.Genus.BXR
SymantecRansom.Ekans
ESET-NOD32a variant of WinGo/Filecoder.Snake.A
APEXMalicious
ClamAVWin.Ransomware.Snake-7546377-0
AlibabaTrojan:Win32/Antavmu.27947a46
NANO-AntivirusTrojan.Win32.Encoder.gvakaa
RisingRansom.Killpror!8.115E0 (C64:YzY0OgkpdeeJ9Npe)
Ad-AwareGen:Trojan.AV-Killer.ItW@aei5Gqj
SophosMal/Generic-R + Troj/Ransom-FUJ
DrWebTrojan.Encoder.30786
ZillyaTrojan.AntiAV.Win32.11788
McAfee-GW-EditionBehavesLike.Win32.Generic.wm
FireEyeGen:Trojan.AV-Killer.ItW@aei5Gqj
EmsisoftGen:Trojan.AV-Killer.ItW@aei5Gqj (B)
SentinelOneStatic AI - Suspicious PE
JiangminTrojan.Antavmu.eyp
WebrootW32.Ransom.Snake
MAXmalware (ai score=100)
Antiy-AVLTrojan/Generic.ASMalwS.2FD388F
KingsoftWin32.Troj.Undef.(kcloud)
MicrosoftRansom:MacOS/Filecoder
GridinsoftRansom.Win32.Snake.dd!s1
ArcabitTrojan.AV-Killer.E64FB6
ViRobotTrojan.Win32.S.SnakeRansom.3718656
GDataGen:Trojan.AV-Killer.ItW@aei5Gqj
CynetMalicious (score: 99)
AhnLab-V3Trojan/Win32.FileCoder.C3866073
TACHYONRansom/W32.Snake.3718656
VBA32Trojan.AntiAV
MalwarebytesRansom.Ekans
TencentWin32.Trojan.Filecoder.Lkee
IkarusTrojan-Ransom.Snake
FortinetW32/Ekans.F82A!tr.ransom
Cybereasonmalicious.f33bad
MaxSecureTrojan.Malware.74756041.susgen
AhnLab-V3Trojan/Win.SnakeRansom.R606246
Antiy-AVLTrojan[Ransom]/Win32.Turla
ArcabitTrojan.Ransom.Ekans.1
BitDefenderGen:Variant.Ransom.Ekans.1
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.Ghanarava.17334428157ef82a
CTXexe.trojan.snake
DeepInstinctMALICIOUS
ESET-NOD32WinGo/Filecoder.Snake.A trojan
ElasticWindows.Ransomware.Snake
EmsisoftGen:Variant.Ransom.Ekans.1 (B)
GDataGen:Variant.Ransom.Ekans.1
GoogleDetected
K7AntiVirusRansomware ( 0061fee61 )
K7GWRansomware ( 0061fee61 )
KasperskyHEUR:Trojan.Win32.Antavmu.gen
KingsoftWin32.Trojan-Ransom.Agent.gen
LionicTrojan.Win32.Snake.4!c
MalwarebytesMalware.AI.4194979624
McAfeeDti!E5262DB186C9
MicroWorld-eScanGen:Variant.Ransom.Ekans.1
RisingRansom.Snake!8.1170E (CLOUD)
SkyhighTrojan-Ransom.b
SophosTroj/Ransom-GAT
TencentMalware.Win32.Gencirc.10bdbcf6
TrellixENSTrojan-Ransom.b
VIPREGen:Variant.Ransom.Ekans.1
VaristW32/Ransom.GMZL-5554
WebrootW32.Trojan.Gen
XcitiumMalware@#3hlbu4qfgaf2f
YandexTrojan.Antavmu!lkuqQwJ5NMA
ZoneAlarmTroj/Ransom-FUJ
alibabacloudRansomware:Win/Snake.AZ
huorongRansom/Snake.a

Process list

NameCommand line
e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60.exe
e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60_unpacked.exe