Classification: Malicious
svchost.exe is a trojan (Windows executable, 251.5 KB). Flagged by 90% of antivirus engines (66 detections).
Detection summary
- 66 antivirus detections (90% detection ratio)
- 0 IDS alerts
- 7 processes observed
- 1 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Backdoor.DarkKomet |
Hybrid-Analysis |
2018-11-17 14:00:05 |
2018-11-17 14:00:05 |
|
|
Sample information
- Filenames
- svchost.exe
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows, ...
- Size
- 257536 bytes
- MD5
6bed3a1d938154eed7e8329d46bab9f8- SHA-1
2c3e5432b889b5d85da3ac1fef9e97d1baa879de- SHA-256
65db4da1f20d3aae86c1498096e8e632b650db64c524da807f51e962d0ef94a9- First indexed
- 2018-11-17 14:00:05
- Last updated
- 2025-06-20 10:04:12
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Trojan.Inject.AUZ |
| APEX | Malicious |
| AVG | Win32:Agent-AWZS [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Inject.AUZ |
| AhnLab-V3 | Win-Trojan/FCN.140610.X1341 |
| Alibaba | Backdoor:Win32/DarkKomet.40c0a7f9 |
| Antiy-AVL | Trojan/Generic.ASBOL.D9B |
| Arcabit | Trojan.Inject.AUZ |
| Avast | Win32:Agent-AWZS [Trj] |
| Avira | BDS/Backdoor.Gen |
| Baidu | Win32.Backdoor.Agent.l |
| BitDefender | Trojan.Inject.AUZ |
| BitDefenderTheta | AI:Packer.0656C1A91C |
| Bkav | W32.AIDetect.malware2 |
| CAT-QuickHeal | Backdoor.Fynloski.A9 |
| ClamAV | Win.Trojan.Darkkomet-6745294-0 |
| Comodo | TrojWare.Win32.Fynloski.B@57zt85 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.d93815 |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| Cyren | W32/Fynloski.L.gen!Eldorado |
| DrWeb | BackDoor.Tordev.976 |
| ESET-NOD32 | a variant of Win32/Fynloski.AN |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.Fynloski (A) |
| FireEye | Generic.mg.6bed3a1d938154ee |
| Fortinet | MalwThreat!238cIV |
| GData | Win32.Backdoor.DarkComet.H |
| Gridinsoft | Backdoor.Win32.Fynloski.zv!n |
| Ikarus | Backdoor.Win32.DarkKomet |
| Jiangmin | Trojan/Genome.bomw |
| K7AntiVirus | Backdoor ( 003b505d1 ) |
| K7GW | Backdoor ( 003b505d1 ) |
| Kaspersky | Backdoor.Win32.DarkKomet.aagt |
| Kingsoft | Heur.SSC.25573.1216.(kcloud) |
| Lionic | Trojan.Win32.DarkKomet.mzOX |
| MAX | malware (ai score=100) |
| Malwarebytes | Generic.Worm.Autorun.DDS |
| MaxSecure | Backdoor.W32.DarkKomet.aagr |
| McAfee | Generic.gj |
| McAfee-GW-Edition | BehavesLike.Win32.Fake.dc |
| MicroWorld-eScan | Trojan.Inject.AUZ |
| Microsoft | VirTool:Win32/CeeInject.AJJ!bit |
| NANO-Antivirus | Trojan.Win32.DarkKomet.ecawjb |
| Paloalto | generic.ml |
| Panda | Trj/Genetic.gen |
| Rising | Backdoor.DarkComet!1.CB87 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Fynloski |
| Sangfor | Trojan.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Sophos | ML/PE-A + Troj/Backdr-ID |
| Symantec | Backdoor.Breut!gm |
| TACHYON | Backdoor/W32.DP-DarkKomet.674304 |
| Tencent | Backdoor.Win32.Darkkomet.a |
| TrendMicro | BKDR_FYNLOS.SMM |
| TrendMicro-HouseCall | BKDR_FYNLOS.SMM |
| VBA32 | Backdoor.DarkKomet |
| VIPRE | Backdoor.Win32.Fynloski.A (v) |
| ViRobot | Backdoor.Win32.Agent.674304.A[UPX] |
| Webroot | W32.Rogue.Gen |
| Zillya | Trojan.Fynloski.Win32.1440 |
| ZoneAlarm | Backdoor.Win32.DarkKomet.aagt |
| Zoner | Trojan.Win32.28205 |
| eGambit | Trojan.Generic |
Process list
| Name | Command line |
|---|
| svchost.exe | |
| cmd.exe | /k attrib "C:\svchost.exe" +s +h |
| attrib.exe | attrib "C:\svchost.exe" +s +h |
| cmd.exe | /k attrib "C:" +s +h |
| attrib.exe | attrib "C:" +s +h |
| svchost.exe | |
| notepad.exe | |