File verdict·Decided by the MT AI Engine

Our call

Malicious

Item: exportrsa.exe
Rating: 1
Author: MalwareTips File Scanner

Hacktool for exporting non-exportable RSA private keys, confirmed by YARA rule HKTL_ExportRSA_Feb22_1, process injection (T1055), and evasion tags.

ExportRSA

Trust score15High risk

MT AI confidence · 90%

exportrsa.exe

17.5 KB

99e23a621c88854578…6aa3b0a97b

Antivirus engines

4 of 76 flagged

Code signing

Unsigned

Age

First seen 7y ago

MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

90%Confidence

Very high

Reasoning

Two tier-1 engines from TrendMicro agree on URSU family, paired with high-severity process injection heuristic and direct-IP C2 pattern. Community annotation explicitly identifies it as an open-source hacktool for private key export, aligning with filename 'exportrsa.exe' and evasion behaviors like debug detection and long sleeps. No signing or trusted history, common but zero-reputation prevalence supports non-benign status. Clean sandbox and children do not outweigh converging hacktool signals.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

TrendMicro (tier1): Trojan.Win32.URSU.AE
communityComments[0]: HKTL_ExportRSA_Feb22_1 YARA rule (hacktool)
triggeredHeuristics[0]: MalwareTips.Synth.ProcessInjection (T1055)
file.tags: detect-debug-environment, long-sleeps
behaviour.contactedIps: 20 direct IPs (e.g., 204.79.197.203, 23.216.147.64)

Points in its favour

15/17 tier1 clean
No malicious sandbox verdict
No malicious dropped children
Common_old prevalence (159 subs)

Points against

Hacktool: Exports non-exportable private keys
Process injection (MITRE T1055)
Direct IP C2 (20 IPs, no DNS)
Evasion: detect-debug-environment, long-sleeps
Tier-1 detections: TrendMicro URSU
Unsigned, zero reputation

What to do

Treat as confirmed hacktool and remove. Monitor for private key tampering or injected processes; full system scan recommended.

Threat family attribution

ursu corroborated by 2 sources

VT (76 engines)
ursu
MT AI Engine
ExportRSA

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

Adversary techniques mapped to the MITRE ATT&CK framework.

T1007T1055T1071T1082T1129T1497

Spawned processes

$(unnamed)

"C:\Users\<USER>\AppData\Local\Temp\executable.exe"

$(unnamed)

%SAMPLEPATH%\99e23a621c888545780f610f418d6dc63f1decc4a0e8838ccf7bcf6aa3b0a97b.exe

$(unnamed)

C:\Windows\System32\wuapihost.exe

$(unnamed)

C:\Windows\System32\DeviceCensus.exe

$(unnamed)

C:\Windows\System32\UI0Detect.exe

$(unnamed)

C:\Program Files\Google3868_572927960\bin\updater.exe

$(unnamed)

C:\Program Files\Google820_762992251\bin\updater.exe

$(unnamed)

C:\Program Files\Google2792_926136421\bin\updater.exe

+2 more processes captured.

Network activity

IP addresses20

204.79.197.203
23.216.147.64
52.251.79.25
20.99.132.105
20.99.184.37
23.216.147.76
20.99.133.109
192.229.211.108
131.253.33.203
20.99.186.246

+10 more

Filesystem & mutexes

Files written2

\Device\ConDrv
\Device\ConDrv\\Connect

Files deleted15

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C3D.tmp.WERInternalMetadata.xml
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C4F.tmp.csv
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C50.tmp.txt
C:\Windows\System32\spp\store\2.0\cache\cache.dat
C:\ProgramData\Microsoft\Windows\WER\Temp\WER3C4.tmp.WERInternalMetadata.xml

+10 more

Dropped payload

Files this sample writes at runtime

This file drops 1 child at runtime. None are currently flagged malicious in our cache.

1 unseen

2a3a3e99cf772c20d567…28e263Never scanned
never seen before

No researcher-database hits

External threat-intel sources were not collected for this scan.

Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

2 synthesis

MITRE ATT&CK profile

Defense evasion× 1C2× 1

MalwareTips synthesis rules

Our heuristics on VT data + sandbox behaviour

ProcessInjection
T1055
high
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence
"C:\Users\<USER>\AppData\Local\Temp\executable.exe"
DirectIpC2
T1071
medium
Sample contacted 20 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence
204.79.197.203 · 23.216.147.64 · 52.251.79.25

Antivirus engine breakdown

4 detections across 76 engines

4 malicious0 suspicious72 clean

Tier-117 engines

2flag

Top commercial AVs (low FP rate)

Tier-238 engines

2flag

Mainstream engines with mixed FP rates

Low-trust21 engines

0flag

Heuristic / generic-AI engines (high FP rate)

CAT-QuickHeal

malicious

Trojan.Ghanarava.1634506062f2a966

TrellixENS

malicious

Artemis!D42F9177A763

TrendMicro

malicious

Trojan.Win32.URSU.AE

TrendMicro-HouseCall

malicious

Trojan.Win32.URSU.AE

Hash 99e23a621c88… cross-referenced against 76 AV engines via our AV network.

PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

Unpacked

Section entropy5 sections

.text

6.05

.rdata

5.20

.data

1.33

.rsrc

5.10

.reloc

4.46

0.0Packed threshold 7.28.0

Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

150

Hundreds of people have uploaded this — common.

Total submissions

159

Includes repeat uploads by the same source.

First seen by VT

7y ago

Jun 2, 2019

Prevalence quadrant

Rare · New

Targeted malware lives here

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Trusted legitimate binaries

File identity

Forensic fingerprint

File biography

First seen (VT)

6/2/2019, 12:35:11 PM

First seen (MalwareBazaar)

—

Last analysis (VT)

11/14/2025, 8:09:47 AM

Scanned here

5/9/2026, 3:51:46 AM

File name: exportrsa.exe
Size: 17.5 KB
MIME type: (unknown)
Detected type: Win32 EXE
SHA-256: 99e23a621c888545780f610f418d6dc63f1decc4a0e8838ccf7bcf6aa3b0a97b
MD5: d42f9177a7636f549d19491c4ef2a966
SHA-1: 11274bc53a2c8b01269fcbb91ec1a57d0bed6dc7
PE imphash: 34d08a421333a7633f63a02a350bd27b
First seen (VT): 6/2/2019, 12:35:11 PM
Last analysis (VT): 11/14/2025, 8:09:47 AM
First scan (MalwareTips): 5/9/2026, 3:51:46 AM
Last scan (MalwareTips): 5/9/2026, 3:51:46 AM

Behavior tags

idlepeexedetect-debug-environmentlong-sleepsdirect-cpu-clock-access

Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…

Loading reports…

Scanned by

harlan4096Staff

Scan another

Check a different file

URL instead?

Check if a link is safe

Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.