Malicious
Kaspersky tier-1 detection of Backdoor.Win64.Agent.smgdot combined with process-injection and direct-IP C2 contact indicates malicious intent.
d7c0543e29311b1d3b…1882389a62The verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file exhibits a coherent malicious profile: Kaspersky (tier-1) named a specific backdoor family rather than issuing a generic heuristic flag, which carries high confidence. Our heuristic engines detected process-injection and direct-IP C2 contact, both hallmarks of backdoor/RAT evasion tactics. Although only 1 tier-1 engine flagged malicious and 16 tier-1 engines reported clean, the specificity of the Kaspersky label combined with the offensive behaviour techniques outweighs the silent majority. The signer is unestablished (no prior samples), removing a potential reputation anchor. The file has medium prevalence (61 submitters, 8 days old), suggesting active distribution rather than a one-off submission. The absence of a malicious sandbox verdict is a mitigating factor, but the process-injection + C2 contact pattern is consistent with backdoor staging or C2 infrastructure unavailability during sandbox execution.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
Kaspersky (tier-1) flagged 'Backdoor.Win64.Agent.smgdot' — named family, not generic heuristic
triggeredHeuristics: MalwareTips.Synth.ProcessInjection [high] + MalwareTips.Synth.DirectIpC2 [medium] — T1055 + direct-IP C2 contact to 162.159.36.2
signing.verified=true but signerStats.found=false — 'Gaston Dallavalle' signer has zero historical samples; no reputation anchor
behaviour.offensiveTechniques=[T1055, T1548] — process injection + elevation abuse, consistent with backdoor evasion
prevalence=medium (61 submitters, 75 submissions) — not rare-new; established distribution pattern
- No malicious sandbox verdict recorded — C2 infrastructure may have been unreachable during analysis
- 16 tier-1 engines reported clean — majority of high-trust detectors silent
- No malicious dropped children or persistence indicators detected
- Tier-1 engine (Kaspersky) detected named backdoor family
- Process injection (T1055) observed — evasion tactic
- Direct-IP C2 contact (162.159.36.2) — bypasses DNS reputation systems
- Privilege escalation attempt (T1548) — post-exploitation indicator
- Unestablished signer with no reputation history
- Medium prevalence (61 submitters) — active distribution
Block this file immediately. The combination of Kaspersky's tier-1 backdoor detection, process-injection behaviour, and direct-IP C2 contact indicates active malware. Assume compromise if executed and conduct forensic investigation.
auplgeherze corroborated by 2 sources
- VT (75 engines)auplgeherze
- MT AI EngineAgent
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 162.159.36.2
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Users\user\Desktop\Ocean-K6H2Q4N6.exe"Sample contacted 1 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence162.159.36.2
2 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- Ocean-V9M5Q8F0.exe
- Size
- 44.41 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- d7c0543e29311b1d3be7ee7faabb2e337c740e644a5e564a1478b01882389a62
- MD5
- 5e95119bff94ac0ad991593646f8bd20
- SHA-1
- 69cceb6df22231771ec2642eecb25b47d5604b2d
- PE imphash
- 79ead2b955970e15a535790a440b7d43
- First seen (VT)
- 6/20/2026, 3:00:13 PM
- Last analysis (VT)
- 6/28/2026, 8:12:39 AM
- First scan (MalwareTips)
- 6/28/2026, 4:41:15 PM
- Last scan (MalwareTips)
- 6/28/2026, 4:41:15 PM
- Code signer
- Gaston Dallavalleverified
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.