Is Loooader.exe safe?
Ten tier-1 engines and a completed sandbox run independently identify packed trojan activity, including process injection, defense impairment, and temporary executable deployment.
The file triggered 36 of 75 engines, including ten high-trust detections naming several trojan or backdoor families. A completed sandbox run also recorded offensive techniques such as process injection and defense impairment, while the unsigned, packed executable wrote another executable into a temporary directory.
a2117746c882e74965…e6852bb09068cbRecommended next actions
Before running
Do not run it. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The file triggered 36 of 75 engines, including ten high-trust detections naming several trojan or backdoor families. A completed sandbox run also recorded offensive techniques such as process injection and defense impairment, while the unsigned, packed executable wrote another executable into a temporary directory.
The antivirus evidence is broad: 36 of 75 engines flagged the sample, including ten tier-1 engines. Microsoft named DCRat, while BitDefender and several other engines used Jalapeno; the disagreement prevents a definitive family attribution but does not weaken the overall malware finding. One completed sandbox run produced a malicious result and mapped activity to T1055 process injection, T1562.001 defense impairment, and three other offensive techniques. The file is unsigned and likely packed, and it wrote another executable into a temporary directory. The inspected domain had no cached malicious classification, but host-reputation coverage did not include every observed contact and therefore does not offset the execution evidence.
What We Detected
Thirty-six of 75 antivirus engines flagged this executable, including ten tier-1 engines. Microsoft reported DCRat, BitDefender and Emsisoft reported Jalapeno, and ESET-NOD32 and Fortinet reported Kryptik variants. These labels disagree on the exact family, so the most defensible description is a packed generic trojan rather than a single confirmed lineage.
Threat Behavior
A completed sandbox run returned a malicious result and recorded five offensive techniques: T1055 process injection, T1485 data destruction, T1548 privilege escalation, T1562.001 defense impairment, and T1620 reflective code loading. The unsigned executable contains high-entropy code, appears packed, and wrote another executable into a temporary directory. It also contacted dex.cy; the cached host check found no known malicious entry for that domain, but it did not cover every separately observed network contact.
What To Do Now
Do not execute the file. Keep endpoint protection enabled, quarantine or remove the sample, and scan the system for the dropped temporary executable and related activity. If it already ran, isolate the device from the network and investigate for credential access, injected processes, defense changes, and additional payloads.
Where this verdict could be wrong4 caveats
- engines.tier1FamilyConsensus.strong=false; only two tier-1 engines converged on MalwareX, and the broader family labels conflict.
- contactedHosts.maliciousHosts is empty for the one inspected domain, although the separately observed IP address was not covered by that cross-check.
- externalIntel.yaraify.ruleCount=0 and externalIntel.circl.hit=false, so researcher-curated sources provide no additional corroboration.
- droppedChildren.hasMaliciousChild=false, but both inspected children remain unknown rather than established benign files.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- contactedHosts found no cached malicious or suspicious classification for the one inspected domain
- droppedChildren.hasMaliciousChild=false
- brandMismatch is not detected
- externalIntel.yaraify.ruleCount=0
- 36/75 antivirus detections
- Ten tier-1 engine detections
- Completed sandbox run returned a malicious result
- T1055 process-injection activity
- T1562.001 defense-impairment activity
- Unsigned and likely packed executable
Do not run this executable; quarantine or delete it while keeping endpoint protection enabled. If it was executed, isolate the system and perform a full incident-response scan for injected processes, credential access, and dropped payloads.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete36 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial1 of 2 contacted hosts were cross-checked; coverage is incomplete.
YARA
Complete4 signature or behavior rules matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 23MITRE ATT&CK techniques
- 12spawned processes
- 2network contacts
- 6filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
High concern: Attempted to impair or bypass security controls.
High concern: Manipulated how the operating system loads code, which can redirect execution.
High concern: Loaded code directly into memory instead of from a normal file.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How trojans work
A trojan disguises itself as something useful or harmless to trick you into running it. Once open, it does its real job in the background — anything from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
Loooader.exe
a2117746c882e7496541c4f57cfe59a0df0f455337f1b59b87e6852bb09068cb
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\Loooader.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\r4 (1).exe"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
r4 (1).exe
C:\Users\<USER>\AppData\Local\Temp\r4 (1).exe
04Isolated runtime analysis - Written fileObserved
Loooader.exe.log
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loooader.exe.log
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
dex.cy
Contact observed during runtime.
06Isolated runtime analysis - Contacted hostObserved
162.159.36.2
Contact observed during runtime.
07Isolated runtime analysis - +1 more recorded observation in Analyst mode
7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox; 1 returned "malicious".
Adversary techniques mapped to the MITRE ATT&CK framework.
- dex.cy
- 162.159.36.2
- HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
- C:\Users\<USER>\AppData\Local\Temp\r4 (1).exe
- C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loooader.exe.log
- C:\Users\user\AppData\Local\Microsoft\Windows\Caches
- C:\Users\user\AppData\Local\Temp\r4 (1).exe
- Global\OneSettingQueryMutex+compat+encapsulation
- \Sessions\1\BaseNamedObjects\Global\PFNX_SideVTSTB01
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache.
- f67c73f57dbf2f40aad5…6d9a4aNever scannednever seen before
- 978228083a455adcd340…c3168dNever scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 4rule hits recorded
- 36 / 75engines flagged
- 18sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 isolated runtime environment classified the observed behavior as malicious.
Verdict inputView chapterProvenanceObservedSourceIsolated runtime analysisObserved at - 02
2 high-confidence signature or behavior rules matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 03
36 of 75 antivirus engines flagged the file, including AhnLab-V3 and ALYac.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 04
Scanned file: Loooader.exe — a2117746c882e7496541c4f57cfe59a0df0f455337f1b59b87e6852bb09068cb
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\Desktop\Loooader.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — "C:\Users\<USER>\AppData\Local\Temp\r4 (1).exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: r4 (1).exe — C:\Users\<USER>\AppData\Local\Temp\r4 (1).exe
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: Loooader.exe.log — C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loooader.exe.log
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: dex.cy — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 10
Contacted host: 162.159.36.2 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: generic-trojan
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pPE is packed (high-entropy code or known packer) AND unsigned AND at least one engine flagged it. Packing alone is common in legit software; packing + unsigned + signal is the malware-dropper pattern.
Evidencepackers: Microsoft Visual C++ vx.x DLLSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exeUnsigned, packed PE with sandbox-observed network activity. The packing step hides the payload until execution; the network call fetches / reports for the next stage. Classic dropper / stager behaviour.
Evidencedex.cy
36 of 75 engines flagged this file
View all 75 engine results
Section entropy & packers
Executable sections have high entropy (7.2+) — the code is compressed or encrypted and only decrypted at runtime. Classic packing behaviour.
Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- Loooader.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 662.0 KB
- Last analyzed
- Oct 3, 2026, 12:57 AM UTC
a2117746c882e7496541c4f57cfe59a0df0f455337f1b59b87e6852bb09068cbSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't run this file. Delete this file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
- Recovery step 04
Get a fresh copy from the developer's official site or an official app store.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is Loooader.exe a virus?
What is Loooader.exe?
How many antivirus engines detected Loooader.exe?
What should I do if I already ran Loooader.exe?
How do I remove Loooader.exe?
What kind of malware is Loooader.exe?
What is the SHA-256 hash of Loooader.exe?
How up to date is this analysis of Loooader.exe?
Community
Member reviews and reports for this exact file hash.