f86ebeb6b3c7f12ae98fe278df707d9ebdc17b19be0c773309f9af599243d0a3.exe

Classification: Malicious

f86ebeb6b3c7f12ae98fe278df707d9ebdc17b19be0c773309f9af599243d0a3.exe is a malicious file sample. Linked to Gallium activity. Detected by 79 antivirus engines.

Detection summary

  • 79 antivirus detections (78% detection ratio)
  • 1 IDS alerts
  • 3 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: GALLIUM (G0093)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2023-08-26 21:45:04 2023-08-26 21:45:04
Gallium MalwareBazaar Abuse.ch 2022-06-16 04:33:18 2022-06-16 04:33:18 malicious-activity G0093 GALLIUM
Generic.Malware MalwareBazaar Abuse.ch 2022-06-16 04:33:18 2022-06-16 04:33:18 malicious-activity

Sample information

Filenames
f86ebeb6b3c7f12ae98fe278df707d9ebdc17b19be0c773309f9af599243d0a3.exe, f86ebeb6b3c7f12ae98fe278df707d9ebdc17b19be0c773309f9af599243d0a3
File type
application/x-dosexec
Size
117248 bytes
MD5
9ad380e7b6d9c83b88ed1b307107912e
SHA-1
6d4cc7f30e0a67432244d1a3bb7c058be7c1795f
SHA-256
f86ebeb6b3c7f12ae98fe278df707d9ebdc17b19be0c773309f9af599243d0a3
First indexed
2022-06-16 05:15:07
Last updated
2026-02-26 03:53:11

Antivirus detections

EngineDetection
BkavW32.Common.9A6D40A6
LionicTrojan.Win64.Agent.m!c
ElasticWindows.Trojan.Pingpull
MicroWorld-eScanGen:Variant.Tedy.141694
ClamAVWin.Trojan.Gallium-9951903-0
FireEyeGeneric.mg.9ad380e7b6d9c83b
ALYacTrojan.Agent.RedCap
Cylanceunsafe
ZillyaTrojan.Agent.Win64.13911
SangforBackdoor.Win64.Agent.Vji1
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaBackdoor:Win64/Backdr.ba0633cc
K7GWTrojan ( 0059464a1 )
K7AntiVirusTrojan ( 0059464a1 )
ArcabitTrojan.Tedy.D2297E
SymantecTrojan Horse
ESET-NOD32Win64/PingPull.A
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Backdoor.Win64.Agent.gen
BitDefenderGen:Variant.Tedy.141694
NANO-AntivirusTrojan.Win64.Redcap.jpqvde
AvastWin64:Malware-gen
RisingBackdoor.Agent!8.C5D (TFE:5:9w8AayEN38S)
EmsisoftGen:Variant.Tedy.141694 (B)
F-SecureBackdoor.BDS/Redcap.bwbpr
DrWebTrojan.Siggen18.8812
VIPREGen:Variant.Tedy.141694
TrendMicroTROJ_GEN.R002C0WFA22
McAfee-GW-EditionBehavesLike.Win64.NetLoader.ch
Trapminesuspicious.low.ml.score
SophosMal/Generic-S
JiangminBackdoor.Agent.lng
WebrootW32.Trojan.Gen
AviraBDS/Redcap.bwbpr
Antiy-AVLTrojan[APT]/Win32.Gallium
XcitiumMalware@#356km0h8qez2l
MicrosoftTrojan:Win32/Casdet!rfn
ViRobotTrojan.Win.Z.Agent.117248.Z
ZoneAlarmHEUR:Backdoor.Win64.Agent.gen
GDataGen:Variant.Tedy.141694
GoogleDetected
AhnLab-V3Trojan/Win.Agent.C5139333
McAfeeRDN/Generic BackDoor
MAXmalware (ai score=100)
VBA32Backdoor.Win64.Agent
MalwarebytesMalware.AI.505296091
PandaTrj/CI.A
TrendMicro-HouseCallTROJ_GEN.R002C0WFA22
TencentMalware.Win32.Gencirc.115d9cb1
IkarusTrojan.Win64.Agent
MaxSecureTrojan.Malware.74210654.susgen
FortinetW64/Agent.BGA!tr
AVGWin64:Malware-gen
Cybereasonmalicious.30e0a6
DeepInstinctMALICIOUS
AlibabaBackdoor:Win64/Tnega.e5718223
BkavW64.AIDetectMalware
CAT-QuickHealTrojan.PingPull.S31613465
CTXexe.trojan.redcap
CylanceUnsafe
ESET-NOD32Win64/PingPull.A trojan
K7AntiVirusBackdoor ( 005cde751 )
K7GWBackdoor ( 005cde751 )
KingsoftWin32.Troj.Generic.jm
LionicTrojan.Win32.Redcap.m!c
MalwarebytesMalware.AI.122513716
McAfeeDti!F86EBEB6B3C7
MicrosoftTrojan:Win64/Tnega.PRI!MTB
Paloaltogeneric.ml
PandaTrj/Chgt.AD
SangforBackdoor.Win64.Tnega.Vcxe
SkyhighBehavesLike.Win64.NetLoader.ch
TrellixENSBackDoor-FEQB!9AD380E7B6D9
TrendMicro-HouseCallBackdoor.Win64.PINGPULL.SMYACFO
VaristW64/Agent.NEIY
ZoneAlarmTroj/Backdr-NJ
alibabacloudBackdoor:Win/IPHelper.AZ
huorongBackdoor/W64.IPHelper.a

Network contacts

92.38.135.62

Process list

NameCommand line
f86ebeb6b3c7f12ae98fe278df707d9ebdc17b19be0c773309f9af599243d0a3.exe
f86ebeb6b3c7f12ae98fe278df707d9ebdc17b19be0c773309f9af599243d0a3.exe
f86ebeb6b3c7f12ae98fe278df707d9ebdc17b19be0c773309f9af599243d0a3.exe-a