Malicious
9 tier-1 engines agree on Trojan.Tedy/Kepavll; process injection and hollowing techniques confirm malware intent.
70cc1bf36efc6204ab…f298f1b384The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
This file exhibits strong malicious indicators across multiple dimensions. Nine tier-1 antivirus engines converge on the Trojan.Tedy/Kepavll family, establishing high-confidence consensus. The 62% detection rate (38/61 engines) spans tier-1, tier-2, and low-trust vendors, ruling out isolated heuristic false positives. Behavioural analysis reveals offensive MITRE techniques: process injection (T1055.003) and process hollowing (T1134) are evasion tactics used exclusively by malware to bypass security hooks. The triggered heuristic 'MalwareTips.Synth.ProcessInjection' confirms the injection pattern at high severity. The file is unsigned with no signer history, removing a trust signal. Community researchers independently classify the sample as malware across Hatching Triage, FileScan, and MWDB, with threat scores of 10/10. The medium prevalence (126 submitters, 131 submissions) indicates established distribution rather than a rare false positive.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines.tier1Malicious=9 (Avira, BitDefender, Emsisoft, Fortinet, GData, Ikarus, Microsoft, Sophos, Symantec) with tier1FamilyConsensus.strong=true on 'variant' family
engines.malicious=38/61 (62% detection rate); onlyLowTrustFlagging=false — consensus spans tier-1 and tier-2 engines
behaviour.offensiveTechniques=[T1055.003 Process Injection, T1134 Process Hollowing, T1620]; triggeredHeuristics 'MalwareTips.Synth.ProcessInjection' fired (high severity)
signing.verified=false, unsigned executable with no signer history; prevalence.classification='medium' (126 submitters, 131 submissions)
communityComments consensus: '#xmrig', '#malware', '#stealer', '#trojan'; independent analyses (Hatching Triage, FileScan, jaffacakes118, MWDB) corroborate malicious classification; Threat Score 10/10
- No malicious sandbox verdict recorded (though process injection is designed to evade sandbox detection)
- No malicious contacted hosts in our URL cache (though behaviour shows process injection into legitimate processes)
- No dropped malicious children recorded (process injection is the attack vector itself)
- 9 tier-1 antivirus engines agree on Trojan.Tedy/Kepavll family classification
- Process injection (T1055.003) and process hollowing (T1134) techniques confirm evasion intent
- 62% detection rate (38/61 engines) across tier-1, tier-2, and low-trust vendors
- Unsigned executable with no publisher history or signer reputation
- Medium prevalence (126 submitters, 131 submissions) indicates established malware distribution
- Community researchers independently corroborate malicious classification across multiple platforms
Remove this file immediately and do not execute it. Scan your system with updated antivirus software to detect and remove any instances. Review system logs for signs of process injection or unusual process activity, and check the source of the download for other potentially compromised files.
tedy corroborated by 2 sources
- VT (75 engines)tedy
- MT AI EngineTrojan.Tedy / Kepavll (xmrig variant)
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\ProgramData\Microsoft\Windows Security Health\Logs
- \Device\ConDrv\\Connect
- \BaseNamedObjects\Local\SM0:6380:304:WilStaging_02
- \BaseNamedObjects\Local\SM0:6380:120:WilError_03
- \BaseNamedObjects\Local\ZonesCacheCounterMutex
- \BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Users\user\Desktop\SimpleM_[unknowncheats.me]_.exe"
38 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- SimpleM_[unknowncheats.me]_.exe
- Size
- 1.48 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 70cc1bf36efc6204abd73fd68b22c386032e568ce8ea18ee63f11df298f1b384
- MD5
- ffc7b0cf3c712119e3a7aacad0511e71
- SHA-1
- 3a3f1ea1f7072348ecdeb860a159548e5f3b0292
- PE imphash
- 8b8cf38370ca50900ee61326f007923c
- First seen (VT)
- 3/28/2026, 10:17:43 PM
- Last analysis (VT)
- 5/25/2026, 12:55:35 AM
- First scan (MalwareTips)
- 6/10/2026, 5:18:20 PM
- Last scan (MalwareTips)
- 6/10/2026, 5:18:20 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.