Is 0x21 viewbot.exe safe?
Thirty-eight of 73 engines flagged this unsigned executable, including nine high-trust detections, while runtime evidence indicates possible T1055 process injection.
The detection pattern strongly supports a trojan associated with the Tedy family: 38 of 73 engines flagged it, including nine high-trust votes. One sandbox also mapped activity to T1055 process injection, and the executable is unsigned; keep endpoint protection enabled and do not run it.
056411a3ef1c584491…d10532141cfdcdRecommended next actions
Before running
Do not run it. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The detection pattern strongly supports a trojan associated with the Tedy family: 38 of 73 engines flagged it, including nine high-trust votes. One sandbox also mapped activity to T1055 process injection, and the executable is unsigned; keep endpoint protection enabled and do not run it.
A substantial 38 of 73 engines detected the executable, and nine high-trust engines contributed independent malicious votes. BitDefender, Emsisoft, TrendMicro, and several others use Tedy-family labels, although the independent tier-1 family consensus is not strong. A completed sandbox mapped activity to T1055 process injection, providing behavioral support beyond static labels. The file is unsigned and has no established publisher history. Intelligence services supplied no additional corroboration, but those negative results do not outweigh the engine breadth and runtime signal. No complete contacted-host reputation result is available because that cross-check was not saved.
What We Detected
Thirty-eight of 73 antivirus engines flagged the executable, including nine high-trust detections. BitDefender and Emsisoft identify Gen:Variant.Tedy.982915, while TrendMicro identifies Trojan.Win64.TEDY.TL0101F126ZY; Microsoft, ESET-NOD32, Sophos, and other engines also report trojan or malware labels. The exact family naming varies, but Tedy is the most repeated specific family.
Threat Behavior
One completed sandbox mapped the observed activity to MITRE T1055, Process Injection. That mapping supports possible code execution inside another process, though it does not establish the precise injection method. The run recorded no network contacts, but no complete contacted-host reputation cross-check is available. The executable is unsigned and has no signer history.
What To Do Now
Do not execute the file. Quarantine or delete it while keeping antivirus and endpoint protection enabled, then run a full system scan if it was opened. If execution occurred, review active processes, startup entries, credentials, and security logs from the affected host.
Where this verdict could be wrong4 caveats
- engines.tier1FamilyConsensus.strong=false because only two independent tier-1 votes agree on Tedy, while several other engines use generic or different family labels.
- behaviour.hasMaliciousSandboxVerdict=false, and the completed sandbox recorded no contacted domains, IPs, or URLs; however, contactedHosts=null means no complete host-reputation result is available.
- externalIntel.yaraify.ruleCount=0, externalIntel.circl.hit=false, and externalIntel.malwareBazaar.hit=false; these absences may reflect intelligence-coverage gaps.
- similarHashes shows 1/2 prior verdicts safe for this imphash, but matchKind=imphash with signerMatchesSubject=false makes that weak collision-prone evidence.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- behaviour.hasMaliciousSandboxVerdict=false
- No dropped file hashes were recorded
- externalIntel.yaraify.ruleCount=0
- peAnalysis.likelyPacked=false
- prevalence.uniqueSources=298
- 38/73 antivirus detections
- Nine high-trust malicious votes
- Repeated Tedy-family labels
- T1055 process-injection evidence
- Unsigned Win32 executable
- No complete contacted-host reputation cross-check
Quarantine or delete the executable and keep endpoint protection enabled. If it was executed, isolate the affected system as appropriate and perform a full scan plus credential and persistence review.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete38 of 73 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Not runNo contacted-host reputation check is recorded.
No timestamp recordedYARA
Complete1 signature or behavior rule matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 6MITRE ATT&CK techniques
- 5spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
High concern: Manipulated how the operating system loads code, which can redirect execution.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How trojans work
A trojan disguises itself as something useful or harmless to trick you into running it. Once open, it does its real job in the background — anything from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
0x21 viewbot.exe
056411a3ef1c584491bca1cc670b0218a91b1312676f2931f8d10532141cfdcd
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\executable.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
cmd /c cls
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
Connect
\Device\ConDrv\\Connect
04Isolated runtime analysis - Written fileObserved
Null
\Device\Null
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
5 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- \Device\ConDrv\\Connect
- \Device\Null
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 1rule hit recorded
- 38 / 73engines flagged
- 298sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 02
38 of 73 antivirus engines flagged the file, including AhnLab-V3 and alibabacloud.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The hash has been submitted 327 times from 298 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 04
Scanned file: 0x21 viewbot.exe — 056411a3ef1c584491bca1cc670b0218a91b1312676f2931f8d10532141cfdcd
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\Desktop\executable.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — cmd /c cls
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: Connect — \Device\ConDrv\\Connect
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: Null — \Device\Null
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: generic-trojan
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence"C:\Users\<USER>\Desktop\executable.exe"
38 of 73 engines flagged this file
View all 73 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- 0x21 viewbot.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 9.5 MB
- Last analyzed
- Sep 20, 2026, 5:15 PM UTC
056411a3ef1c584491bca1cc670b0218a91b1312676f2931f8d10532141cfdcdSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't run this file. Delete this file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
- Recovery step 04
Get a fresh copy from the developer's official site or an official app store.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is 0x21 viewbot.exe malware?
What is 0x21 viewbot.exe?
How many antivirus engines detected 0x21 viewbot.exe?
I already downloaded and ran 0x21 viewbot.exe — what should I do?
How do I remove 0x21 viewbot.exe?
What kind of malware is 0x21 viewbot.exe?
What is the SHA-256 hash of 0x21 viewbot.exe?
How up to date is this analysis of 0x21 viewbot.exe?
Community
Member reviews and reports for this exact file hash.