crack.exe

Classification: Malicious

crack.exe is a malicious file sample (Windows executable). Linked to Shimrat malware. 8 sightings from 4 threat sources, last seen 2026-10-16.

Detection summary

  • 0 antivirus detections
  • 13 IDS alerts
  • 0 processes observed
  • 8 contacted hosts
  • 10 DNS requests

MITRE ATT&CK associations

Malware families: SHIMRAT (S0444)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Shim RAT ThreatFox Abuse.ch 2026-10-15 18:36:22 2026-10-16 11:25:39 malicious-activity S0444 ShimRat
Milleniumrat Triage 2026-03-31 16:34:33 2026-10-14 19:45:24 malicious-activity
MilleniumRAT MalwareBazaar Abuse.ch 2026-10-14 19:44:55 2026-10-14 19:44:55 malicious-activity
Generic Malware Hybrid-Analysis 2026-02-06 18:45:13 2026-03-31 17:45:05

Tags

evasive infostealer suspicious windows-server-utility malicious milleniumrat quasar xworm credential_access defense_evasion discovery execution persistence rat spyware stealer trojan privilege_escalation win.shimrat

Sample information

Filenames
crack.exe, f36e5b52f5fff2806a069f28717d9fedef2a4ec1a91f0d0659c815e801050e7a.bin
File type
PE32 executable for MS Windows 6.00 (GUI), Intel i ...
MD5
88c6c9f1dc7417d65e5aaa9f0c62175c
SHA-1
8bd4f031d239426465d3ec5278406ab087d6fd1a
SHA-256
f36e5b52f5fff2806a069f28717d9fedef2a4ec1a91f0d0659c815e801050e7a
First indexed
2026-02-06 17:35:29
Last updated
2026-10-16 11:25:50

Network contacts

57.129.85.4 149.154.166.110 208.95.112.1 185.199.108.133 34.117.59.81 142.250.189.163 160.202.167.55 104.26.12.205

DNS requests

thesnapchatmodapk.com www.thesnapchatmodapk.com api.ipify.org api.telegram.org destinystealer.com gstatic.com ip-api.com ipinfo.io raw.githubusercontent.com upload.gofile.io