Malicious
Nine tier-1 antivirus engines converge on generickd trojan; unsigned executable exhibits process injection, credential-dumping, and direct-IP C2 contact.
40c6b8bec9237a1e0f…26d3fc1977The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The evidence converges on malicious intent. Nine tier-1 engines (BitDefender, Microsoft, TrendMicro, Emsisoft, GData, Sophos, Symantec, Fortinet, and TrendMicro-HouseCall) agree on the generickd trojan family, establishing strong consensus. The file exhibits three offensive MITRE techniques: process injection (T1055) via CreateRemoteThread/APC, credential-dumping targeting LSASS (Mimikatz-shape behaviour), and direct-IP C2 contact to 11 external addresses with zero DNS queries — a hallmark of malware evading reputation-based blocklists. The file is unsigned and has no signer history, eliminating the possibility of a legitimate publisher. Community researchers flagged suspicious hacktools strings via Nextron YARA rules. The high submission volume (275 in 11 days) reflects rapid propagation, not a false positive.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
tier1FamilyConsensus.strong=true; 9 tier-1 engines (BitDefender, Emsisoft, GData, Microsoft, Sophos, Symantec, TrendMicro, TrendMicro-HouseCall, Fortinet) agreeing on 'generickd' family
T1055 (Process Injection) + triggeredHeuristics 'MalwareTips.Synth.ProcessInjection' (high) — CreateRemoteThread/APC injection observed in sandbox
triggeredHeuristics 'MalwareTips.Synth.CredentialDumper' (medium) — LSASS memory access targeting, Mimikatz-shape behaviour
triggeredHeuristics 'MalwareTips.Synth.DirectIpC2' (medium) — 11 external IPs contacted, zero domains; direct-IP C2 bypasses reputation systems
signing.verified=false; unsigned executable; no signer history; communityComments cite Nextron YARA 'Generic_Strings_Hacktools' rule match
- No malicious dropped children detected
- No persistence indicators (registry keys, scheduled tasks) observed in sandbox
- No malicious contacted hosts in our URL cache (though direct-IP C2 bypasses this check)
- Process injection (T1055) — payload smuggled into legitimate processes to evade detection
- Credential dumping — LSASS targeting for password/hash theft
- Direct-IP C2 contact — 11 external IPs, zero DNS, bypasses reputation systems
- Unsigned executable — no legitimate publisher backing
- Tier-1 consensus — 9 high-trust engines agree on generickd family
- Rapid propagation — 275 submissions in 11 days suggests active distribution
Block this file immediately at the network and endpoint level. If execution is suspected, treat as a credential-compromise incident and reset all passwords. Escalate to incident response for forensic analysis and lateral-movement assessment.
tl0101fq26zy corroborated by 2 sources
- VT (75 engines)tl0101fq26zy
- MT AI Enginegenerickd
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 150.171.109.183
- 104.18.27.243
- 150.171.73.13
- 104.18.26.243
- 104.18.94.41
- 178.162.136.155
- 104.16.79.73
- 150.171.110.195
- 162.159.134.233
- 224.0.0.251
- C:\Users\<USER>\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1E73866B-6848-11F1-B614-028F5737F333}.dat
- C:\Users\<USER>\AppData\Local\Temp\~DFA42400B7393E610B.TMP
- C:\Users\<USER>\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{1E73866D-6848-11F1-B614-028F5737F333}.dat
- C:\Users\<USER>\AppData\Local\Temp\~DF315D4305C2E516EC.TMP
- C:\Users\user\AppData\Local\Microsoft\Windows\History
- C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\4d13eb44-8299-416f-8dec-fc85e8843116.tmp
- C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences~RF64633.TMP
- C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\137c55a4-fc48-463a-997a-a4714a8ee417
- C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State~RF633b5.TMP
- Local\!BrowserEmulation!SharedMemory!Mutex
- Local\VERMGMTBlockListFileMutex
- Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2184
- Local\URLBLOCK_HASHFILESWITCH_MUTEX
- Local\URLBLOCK_DOWNLOAD_MUTEX
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exeSample contacted 11 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence150.171.109.183 · 104.18.27.243 · 150.171.73.13
23 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Forensic fingerprint
- File name
- fflag injector (1).exe
- Size
- 277.0 KB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 40c6b8bec9237a1e0fadcb40c367b8efacde417e2a00cc624563b026d3fc1977
- MD5
- ed3913e420b237fa72fa51fc52829272
- SHA-1
- a06b7037f5299dd6c507f3daceb10120e1929106
- PE imphash
- a322b86772fc2edfcc6c176fb44d41e9
- First seen (VT)
- 6/17/2026, 4:06:53 PM
- Last analysis (VT)
- 6/27/2026, 8:11:10 PM
- First scan (MalwareTips)
- 6/28/2026, 10:48:53 AM
- Last scan (MalwareTips)
- 6/28/2026, 10:48:53 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.