S0253 - RunningRAT

RunningRAT is a remote access tool that appeared in operations surrounding the 2018 Pyeongchang Winter Olympics along with Gold Dragon and Brave Prince.

Author
agomez
Created
2023-08-14 16:00:55
Last updated
2026-02-07 19:18:47
Downloads
279946
Hostname indicators
1
Sample indicators
24

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

sky.hobuff.info Hostname

modified 2026-10-16 08:38:04
Top Popularity Site (Cisco Umbrella) · Running RAT (ThreatFox Abuse.ch) · Gen:Variant.Graftor (Hybrid-Analysis) · Trojan.APosT (Hybrid-Analysis) · Farfli (Hybrid-Analysis)

f1cf2b82b0ec58426d7983e939d0989ad7bd5425993012eab4455c6ad0bbe22b Sample

modified 2026-10-12 06:02:35
RunningRAT (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

jaffacakes118_Trojan-Dropper.Win32.Agent.bjvbml.25cb1828b9071456b4532ae922a255c8 Sample

modified 2026-10-06 15:28:56
Runningrat (Triage)

64.exe Sample

modified 2026-09-14 08:56:32
RunningRAT (MalwareBazaar Abuse.ch) · Running RAT (ThreatFox Abuse.ch) · Gh0strat (Triage)

d1347d9e940bd05c1e34f37c9c716314b88fe6edd243719307df79dbaaedebfd Sample

modified 2026-09-13 01:45:06
RunningRAT (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

08d49d88c70b139a00f9eb87de734644.exe Sample

modified 2026-09-09 00:53:04
RunningRAT (Abuse.ch)

bb46d0c8b43a92fda32622b15fd8060dedf1f0666c8e536cdad49ad3e1a79ade Sample

modified 2026-09-08 04:45:09
RunningRAT (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

b6e1c130d2b9f81e9457197727bb12e29093f29bf80408c2351bbad8cf821d4f Sample

modified 2026-09-07 21:45:05
RunningRAT (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

a4cdb56a6b905ad47a796da718a187e862fee0e713755f97cc197838f3111e28 Sample

modified 2026-09-06 18:45:05
RunningRAT (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

25ad9ca13dc1ee44d8c3a3d0fba9365d9e9fd65db1411a0f720dd036d11911f3 Sample

modified 2026-08-18 23:45:04
RunningRAT (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

223278e7f27613207535c392734433b4413da28fe44e43c89c2379475430f67d Sample

modified 2026-08-18 12:45:05
RunningRAT (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412 Sample

modified 2026-08-18 00:45:08
RunningRAT (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

2026-07-17_cf1ad47807fb18a7d44c83f5ef1dd053_dark-comet_darkgate_elex_gcleaner_glassworm_wannacry Sample

modified 2026-07-18 02:01:00
Runningrat (Triage)

2026-04-14_bab50bc000a21ef8a0f5afeed84c4f8b_elex_runningrat_wannacry_zxshell Sample

modified 2026-06-16 10:43:15
Generic Malware (Hybrid-Analysis) · Runningrat (Triage)

2026-05-23_205d8d79b80c2b18ff8433011a2ff1f0_cobalt-strike_elex_wannacry_zxshell Sample

modified 2026-05-23 01:57:56
Runningrat (Triage)

2026-05-06_7b9031957cf6ab55066d8dd9eb9a64a8_elex_runningrat_wannacry_zxshell Sample

modified 2026-05-06 07:29:03
Runningrat (Triage)

cf6be26cbfc87fb85d345f97edd03ddc1f157c57fa3cd60da23a8cba71615842.bin Sample

modified 2026-04-23 02:22:27
RunningRAT (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

2026-04-20_9723927e3c54655b9c66184d3dbfd00b_elex_runningrat_wannacry_zxshell Sample

modified 2026-04-20 13:39:58
Runningrat (Triage)

Third_stage (1).bin Sample

modified 2026-04-08 04:48:09
RunningRAT (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

server.exe Sample

modified 2026-03-13 09:20:08
RunningRAT (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell Sample

modified 2026-03-13 06:52:11
Runningrat (Triage)

db312628b3001d24ca2836ab065bed9573f65158a3b31d97f009f44110c4a4cb Sample

modified 2026-03-03 18:33:12
RunningRAT (MalwarePatrol)

152f1bf6b11eb2f8e0f31bce6853f7f9fa604164a429741ec0973f508f6520e1 Sample

modified 2026-03-03 18:33:11
RunningRAT (MalwarePatrol)

1.exe Sample

modified 2026-02-17 16:18:54
RunningRAT (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

92b81afb69efbe857c74d07e464b4097.exe Sample

modified 2025-10-24 16:27:16
RunningRAT (Abuse.ch)

829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe Sample

modified 2025-10-15 10:04:13
RunningRAT (MalwareBazaar Abuse.ch) · Backdoor (VM-Ray) · Generic Malware (Hybrid-Analysis)

cdc887bb5bff153dcff3330f0fbb9bdf.exe Sample

modified 2025-10-15 05:55:32
RunningRAT (Abuse.ch)

xghk.exe Sample

modified 2025-10-14 22:42:50
RunningRAT (MalwareBazaar Abuse.ch)

73096690ffc9dad9df868fa94030607f4361bf9cd4e6a0f7e940d8696d758f4c.exe Sample

modified 2025-10-12 13:23:18
RunningRAT (MalwareBazaar Abuse.ch) · Backdoor (VM-Ray) · Generic Malware (Hybrid-Analysis)

0bc33382f089575b7655909dd37e12e6.exe Sample

modified 2025-10-09 06:34:03
RunningRAT (Abuse.ch)

d6e428677d03e98845a2c84cb1e04ade.exe Sample

modified 2025-10-08 00:20:57
RunningRAT (Abuse.ch)

Server.exe Sample

modified 2025-03-01 21:06:39
RunningRAT (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch)

86.exe Sample

modified 2023-06-30 17:00:03
Generic Malware (Hybrid-Analysis) · RunningRAT (MalwareBazaar Abuse.ch)