_e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda.exe

Classification: Malicious

_e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda.exe is a trojan (Windows 64-bit executable). Detected by 58 antivirus engines.

Detection summary

  • 58 antivirus detections
  • 0 IDS alerts
  • 0 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: COBALT STRIKE (S0154)

Intrusion sets: LOTUS BLOSSOM (G0030)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Cyber Threat Alliance 2026-09-28 15:00:46 2026-10-12 16:00:51 malicious-activity
LOTUS PANDA MalwarePatrol 2026-03-03 17:50:01 2026-03-03 18:04:21 malicious-activity G0030 Lotus Blossom
Generic Malware Hybrid-Analysis 2026-02-03 03:45:05 2026-02-03 04:45:13
Cobalt Strike Triage 2026-02-03 03:33:26 2026-02-03 03:33:26 malicious-activity S0154 Cobalt Strike

Tags

cobaltstrike backdoor trojan lotus panda g0030 spring dragon dragonfish atk1 bronze elgin st group red salamander lotus blossom

Sample information

Filenames
e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda.bin, _e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda.exe
File type
PE32+ executable for MS Windows 5.02 (GUI), x86-64 ...
MD5
6aed7e49bd6c10c4eaee34f8c0eaa055
SHA-1
9fbf2195dee991b1e5a727fd51391dcc2d7a4b16
SHA-256
e7cd605568c38bd6e0aba31045e1633205d0598c607a855e2e1bca4cca1c6eda
SHA-512
c76a19ffe6ad8d0099115a76bd4c126801597b680da17121c8c18eda2aac405b6949a6e5146f5e189a19d247a7361049e6ecc9441fd579ca655feabcc00f22e5
First indexed
2026-02-03 03:26:08
Last updated
2026-09-10 20:02:36

Antivirus detections

EngineDetection
ALYacGeneric.ShellCode.Marte.F.DF815032
APEXMalicious
AVGWin64:Trojan-gen
AhnLab-V3Malware/Win64.Trojan.C4299466
AlibabaTrojan:Win64/Cobalt.fb6cdb91
Antiy-AVLRiskWare/Win64.Artifact
ArcabitGeneric.ShellCode.Marte.F.DFDC6FB8
AvastWin64:Trojan-gen
AviraHEUR/AGEN.1362598
BitDefenderGeneric.ShellCode.Marte.F.DF815032
BkavW64.AIDetectMalware
CAT-QuickHealTrojan.Shelma.S17675250
CTXexe.trojan.cobaltstrike
ClamAVWin.Countermeasure.LoaderWinGeneric-9804845-2
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
DrWebBackDoor.CobaltStrike.34
ESET-NOD32Win64/CobaltStrike.Artifact.L.gen trojan
Elasticmalicious (high confidence)
EmsisoftGeneric.ShellCode.Marte.F.DF815032 (B)
F-SecureHeuristic.HEUR/AGEN.1362598
FortinetW64/Kryptik.BVR!tr
GDataGeneric.ShellCode.Marte.F.DF815032
GoogleDetected
IkarusTrojan.Win64.Crypt
JiangminTrojan.Shelma.mkj
K7AntiVirusTrojan ( 005ce2961 )
K7GWTrojan ( 005ce2961 )
KasperskyTrojan.Win64.Cobalt.bqb
Kingsoftmalware.kb.a.721
LionicTrojan.Win32.CobaltStrike.4!c
MalwarebytesTrojan.CobaltStrike
MaxSecureTrojan.Malware.133898145.susgen
McAfeeDti!E7CD605568C3
MicroWorld-eScanGeneric.ShellCode.Marte.F.DF815032
MicrosoftTrojan:Win32/CobaltStrike!ic
NANO-AntivirusTrojan.Win64.CobaltStrike.kxvtyx
Paloaltogeneric.ml
PandaTrj/GdSda.A
RisingBackdoor.CobaltStrike!8.197F7 (CLOUD)
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win64.Infected.lm
SophosATK/Cobalt-A
TencentMalware.Win32.Gencirc.10bf53e9
TrellixENSArtemis!6AED7E49BD6C
TrendMicroTrojan.Win64.LOADER.SM
TrendMicro-HouseCallTrojan.Win64.LOADER.SM
VIPREGeneric.ShellCode.Marte.F.DF815032
VaristW64/ABTrojan.EBBY-8396
ViRobotTrojan.Win.Z.Cobaltstrike.18944.CR
WebrootW32.Trojan.Gen
ZillyaTrojan.Cobalt.Win64.475
ZoneAlarmATK/Cobalt-A
alibabacloudTrojan:Win/WinGeneric.d9811f37
huorongBackdoor/W64.CobaltStrike.e

Network contacts

124.222.137.114