File scan report
Verdict Suspicious
Is Bar
Five of the 69 antivirus engines that checked it flagged the executable, two naming ZxShell, while observed token manipulation and injection outweigh its valid signature and…
Read the whole reasonShow less
Why Suspicious? 5 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
5 of 69 flagged
- Flagged 5
- No detection 64
- No result 6
- Code signing Hangzhou Shunwang Technology Co.
- Test run Completed
- First seen 8y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
DrWeb and VBA32 identify ZxShell, and three other engines also flag the executable. Evidence from the test run includes token manipulation and injection into WMIADAP.EXE, but a valid signature, a clean sandbox verdict, and no flagged contacted hosts prevent a definitive family attribution.
Five of the 69 antivirus engines that checked it flagged the executable, with DrWeb and VBA32 independently naming the ZxShell backdoor family. Only DrWeb is major, so there is no strong major family consensus, while 16 major antivirus engines did not flag it. Observation from the test run mapped and recorded injection into WMIADAP.EXE, which is more concerning than the numerous techniques common in legitimate software. The file is validly signed, but the publisher is neither curated as trusted nor supported by historical signer statistics. The completed sandbox returned clean, all 17 observed hosts lacked malicious or suspicious cache matches, and no malware-specific external rules or malicious files it created corroborated the detections. These conflicting indicators warrant isolation and further validation rather than execution.
What We Detected
Five of the 69 antivirus engines that checked it flagged BarMonit.exe. DrWeb reported BackDoor.Zxshell.60 and VBA32 reported Backdoor.Zxshell, while Skyhigh and TrellixENS used generic Artemis trojan labels and DeepInstinct returned a generic malicious result. Only one major antivirus engine identified ZxShell, so the named-family evidence is notable but not a strong major consensus.
Threat Behavior
One completed sandbox run returned clean, but data from the test run mapped token manipulation and recorded injection into WMIADAP.EXE. That behavior can be abused for privilege or execution-context manipulation, although the remaining observed techniques were largely common system-discovery and application activity. The full set of 17 observed hosts was checked against the available host cache, with no malicious or suspicious matches.
Trust and Context
The executable carries a valid signature from Hangzhou Shunwang Technology Co. However, the publisher is not on the curated trusted list and has no established historical sample record here, so the signature does not neutralize the detections or injection evidence. No malware-specific researcher rules, known malicious files it created, packing, or high-entropy code provided additional corroboration.
What To Do Now
Do not run the file on a production system. Keep security software enabled, let your antivirus remove the executable, and obtain a fresh copy from a verified official distribution channel if the software is required; an isolated sandbox or analyst review should be used before any release.
Where this verdict could be wrong4 caveats
- The executable has a valid signature from Hangzhou Shunwang Technology Co., although no trusted-publisher match or historical signer record supports it.
- The completed sandbox run returned clean, and none of the 17 observed hosts matched the malicious or suspicious host cache.
- Sixteen of 17 major antivirus engines did not flag the file, and no strong major family consensus formed.
- No malware-specific researcher rules, known malicious file it created, packing, or high-entropy code corroborated the detections.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The executable has a cryptographically verified signature from Hangzhou Shunwang Technology Co.
- The completed sandbox run did not issue a malware finding.
- None of the 17 observed hosts matched known malicious or suspicious host records.
- Sixteen major antivirus engines did not flag the file.
- No packing, high-entropy code, malware-specific researcher-rule match, or malicious file it created was found.
- Five antivirus engines flagged the executable, including DrWeb identifying the ZxShell backdoor family.
- Two engines independently used ZxShell-specific labels rather than only generic rule-based names.
- Data from the test run recorded token manipulation and injection into WMIADAP.EXE.
- The file has a negative reputation score and relatively limited distribution history.
- The signer has no established clean sample history in the available records.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 20sandbox rule tags
- 5spawned processes
- 3network contacts
- 9filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Used an unusual way to talk to a server.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the network settings of the test computer.
Note: Listed the programs running on the test computer.
Note: Talked to servers over the internet during the test run.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
BarMonit.exe
cd9c079f6a6a2a1d0722c909497a90022535e8f478bf3df8ef6e02c2011272a2
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
BarMonit.exe
Test run - Evidence 3 of 5: ProcessSeen in the test run
cd9c079f6a6a2a1d0722c909497a90022535e8f478bf3df8ef6e02c2011272a2.exe
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 4 of 5: Contacted hostSeen in the test run
104.96.203.18
Contacted during the test run.
Test run - Evidence 5 of 5: Contacted hostSeen in the test run
23.55.219.177
Contacted during the test run.
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 20 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
5 of the 69 antivirus engines that checked it flag it; signed by Hangzhou Shunwang Technology Co..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 5
- DrWeb (major engine)BackDoor.Zxshell.60
- TrellixENS (major engine)Artemis!071B20FFFC92
- DeepInstinctMALICIOUS
- SkyhighArtemis!Trojan
- VBA32Backdoor.Zxshell
File fingerprint
- Last analyzed
- Oct 10, 2026, 3:46 PM UTC
- SHA-256
cd9c079f6a6a2a1d0722c909497a90022535e8f478bf3df8ef6e02c2011272a2- SHA-1
462cb429cbc3db3119bceecee13e573245a25873- MD5
071b20fffc922416a37e970feacf881b
About this file
BarMonit.exe is a Win32 EXE file of 1.7 MB.
- Type and size
- Win32 EXE · 1.7 MB
- Signer
- Hangzhou Shunwang Technology Co.Valid code signature.
- First seen
- Jul 5, 2018On VirusTotal.
- Submitted by
- 17 distinct sources
- Packer
- None detected
- Entropy
- 6.31 of 8
First scanned
Includes every engine result (75), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is BarMonit.exe safe, or is it malware?
What is BarMonit.exe?
How many antivirus engines detected BarMonit.exe?
What should I do if I already ran BarMonit.exe?
Is BarMonit.exe digitally signed?
What is the SHA-256 hash of BarMonit.exe?
How up to date is this analysis of BarMonit.exe?
Community
Member reviews and reports for this exact file hash.