f5c0a71b972a63ce6a5e503a0902c8481f788a580a5cbf2246ee4a163bcd44b2

Classification: Malicious

f5c0a71b972a63ce6a5e503a0902c8481f788a580a5cbf2246ee4a163bcd44b2 is a trojan (Office document). Detected by 33 antivirus engines. Linked to Metamorfo malware.

Detection summary

  • 33 antivirus detections
  • 5 IDS alerts
  • 0 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: METAMORFO (S0455)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2026-02-09 15:45:06 2026-04-27 14:45:03
Metamorfo MalwareBazaar Abuse.ch 2026-02-09 15:03:15 2026-02-09 15:03:15 malicious-activity S0455 Metamorfo

Tags

evasive adware

Sample information

Filenames
f5c0a71b972a63ce6a5e503a0902c8481f788a580a5cbf2246ee4a163bcd44b2.msi, f5c0a71b972a63ce6a5e503a0902c8481f788a580a5cbf2246ee4a163bcd44b2, f5c0a71b972a63ce6a5e503a0902c8481f788a580a5cbf2246ee4a163bcd44b2.bin
File type
Composite Document File V2 Document, Little Endian ...
MD5
8b18b1bb132496f243db022023bfc726
SHA-1
7fc260f7ea6b532774ef0ba1607c61a4689629d2
SHA-256
f5c0a71b972a63ce6a5e503a0902c8481f788a580a5cbf2246ee4a163bcd44b2
First indexed
2026-02-09 15:03:15
Last updated
2026-09-28 00:46:11

Antivirus detections

EngineDetection
ALYacAdware.GenericKD.61121326
AVGWAT:Blacked-E
ArcabitAdware.Generic.D3A4A32E
AvastWAT:Blacked-E
AviraTR/Spy.Banker.Gen
BitDefenderAdware.GenericKD.61121326
CAT-QuickHealTrojan.Ghanarava.17728667354595f1
CTXmsi.trojan.ponteiro
CynetMalicious (score: 99)
ESET-NOD32Win32/Packed.Enigma.AAF trojan
EmsisoftAdware.GenericKD.61121326 (B)
F-SecureTrojan.TR/Spy.Banker.Gen
FortinetRiskware/Application
GoogleDetected
IkarusTrojan.Win32.Enigma
K7AntiVirusRiskware ( 005d0b901 )
K7GWRiskware ( 005d0b901 )
KasperskyTrojan-Banker.Win32.Ponteiro.cwg
LionicTrojan.Win32.Ponteiro.7!c
MicroWorld-eScanAdware.GenericKD.61121326
MicrosoftTrojan:Win32/Etset!rfn
SangforSuspicious.Win32.Save.ins
SentinelOneStatic AI - Malicious MSI
SkyhighArtemis!Trojan
SophosMal/Generic-S
SymantecTrojan.Gen.MBT
TencentWin32.Trojan-Banker.Ponteiro.Ncnw
TrellixENSArtemis!A649C8647CA0
VIPREAdware.GenericKD.61121326
VaristW32/ABApplication.BKNN-3813
VirITTrojan.MSI.Agent.JEV
ZillyaTrojan.Ponteiro.Win32.917
alibabacloudRiskware:Win/Packed.Enigma.AM!

Network contacts

191.252.214.115