f333289bf29805ee697908ecb974aeb81206b471252ec.exe

Classification: Malicious

f333289bf29805ee697908ecb974aeb81206b471252ec.exe is a trojan (Windows executable, 429.5 KB). Flagged by 42% of antivirus engines (30 detections).

Detection summary

  • 30 antivirus detections (42% detection ratio)
  • 0 IDS alerts
  • 4 processes observed
  • 3 contacted hosts
  • 2 DNS requests

MITRE ATT&CK associations

Intrusion sets: APT37 (G0067)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Apt37 Maltiverse 2023-07-04 04:28:50 2023-07-05 20:51:12 malicious-activity G0067 APT37
Generic Malware Hybrid-Analysis 2023-01-03 14:00:03 2023-01-03 14:00:03

Tags

apt stealer

Sample information

Filenames
f333289bf29805ee697908ecb974aeb81206b471252ec.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
439808 bytes
MD5
8c14bb1505244971374a88f37a4ec22a
SHA-1
cebd478fd7ca3956c983fb3e33e2cbb7c54fa4d0
SHA-256
f333289bf29805ee697908ecb974aeb81206b471252ec2e51f382d53ac35d962
First indexed
2023-01-03 13:45:10
Last updated
2023-07-05 20:51:13

Antivirus detections

EngineDetection
BkavW32.AIDetectNet.01
LionicTrojan.Win32.Agent.Y!c
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusRiskware ( 0040eff71 )
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.fd7ca3
CyrenW32/Kryptik.IBG.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.HSDU
APEXMalicious
ClamAVWin.Packer.pkr_ce1a-9980177-0
KasperskyUDS:Trojan-Banker.Win32.Bandra.gen
AvastWin32:PWSX-gen [Trj]
TrendMicroRansom.Win32.STOP.SMYXCLS.hp
McAfee-GW-EditionBehavesLike.Win32.Lockbit.gc
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.8c14bb1505244971
SophosML/PE-A + Troj/Krypt-SY
MicrosoftTrojan:Win32/Sabsik.FL.B!ml
GoogleDetected
Acronissuspicious
McAfeeArtemis!8C14BB150524
VBA32BScope.Backdoor.dcRAT
Rising[email protected] (RDML:jOgy8Sre2IGIQVaQmjnrKw)
SentinelOneStatic AI - Malicious PE
MaxSecureTrojan.Malware.300983.susgen
AVGWin32:PWSX-gen [Trj]

Network contacts

149.154.167.99 192.124.249.24 5.75.173.242

DNS requests

ocsp.godaddy.com t.me

Process list

NameCommand line
f333289bf29805ee697908ecb974aeb81206b471252ec.exe
f333289bf29805ee697908ecb974aeb81206b471252ec.exe
cmd.exe/c timeout /t 6 & del /f /q "C:\f333289bf29805ee697908ecb974aeb81206b471252ec.exe" & exit
timeout.exetimeout /t 6