RuntimeBroker.exe
Classification: Malicious
RuntimeBroker.exe is a trojan (Windows 64-bit executable). Detected by 52 antivirus engines. Linked to Sidewinder activity. 4 sightings, last seen 2026-05-22.
Detection summary
- 52 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 1 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Intrusion sets: SIDEWINDER (G0121)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Generic Malware | Triage | 2026-05-21 09:23:12 | 2026-05-22 06:55:18 | malicious-activity | |
| Generic Malware | Hybrid-Analysis | 2026-05-21 09:45:03 | 2026-05-21 09:45:03 | ||
| SideWinder | MalwareBazaar Abuse.ch | 2026-05-21 09:22:12 | 2026-05-21 09:22:12 | malicious-activity | G0121 Sidewinder |
Tags
evasive windows-server-utility defense_evasion discoverySample information
- Filenames
- 4a83420375c564b987d3dfbc073aa963, RuntimeBroker.exe, _04016d3ac1b30375de773a8fd63a4d7f60aa36ab5679b1714e2d98ac88979505.exe, 04016d3ac1b30375de773a8fd63a4d7f60aa36ab5679b1714e2d98ac88979505.bin
- File type
- PE32+ executable for MS Windows 5.02 (GUI), x86-64 ...
- MD5
4a83420375c564b987d3dfbc073aa963- SHA-1
87e1c0a041f27a9c9faf85a915d67970de3f0661- SHA-256
04016d3ac1b30375de773a8fd63a4d7f60aa36ab5679b1714e2d98ac88979505- First indexed
- 2026-05-21 09:22:12
- Last updated
- 2026-08-25 01:29:20
Antivirus detections
| Engine | Detection |
|---|---|
| Antiy-AVL | Trojan/Win64.Sidewinder |
| Avira | TR/W64.Agent |
| CrowdStrike | win/malicious_confidence_90% (W) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 99) |
| DeepInstinct | MALICIOUS |
| ESET-NOD32 | Generik.KKOEDHD trojan |
| Elastic | malicious (high confidence) |
| F-Secure | Trojan.TR/W64.Agent |
| Kaspersky | HEUR:Trojan.Win64.SideWinder.gen |
| Kingsoft | Win64.Trojan.SideWinder.gen |
| McAfeeD | ti!04016D3AC1B3 |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| Rising | Trojan.SideWinder!8.19DA8 (CLOUD) |
| SentinelOne | Static AI - Suspicious PE |
| Symantec | ML.Attribute.HighConfidence |
| Trapmine | malicious.moderate.ml.score |
| ALYac | Trojan.Agent.Sidewinder |
| AVG | Win64:MalwareX-gen [Misc] |
| AhnLab-V3 | Trojan/Win.Generic.C5887412 |
| Alibaba | TrojanSpy:Win64/SideWinder.eee6efb3 |
| Arcabit | Trojan.Generic.D4C74BEF |
| Avast | Win64:MalwareX-gen [Misc] |
| BitDefender | Trojan.GenericKD.80169967 |
| CTX | exe.trojan.sidewinder |
| DrWeb | Trojan.PWS.Siggen5.33571 |
| ESET-NOD32 | Win64/Spy.Agent.AMO trojan |
| Emsisoft | Trojan.GenericKD.80169967 (B) |
| Fortinet | W32/PossibleThreat |
| GData | Trojan.GenericKD.80169967 |
| Detected | |
| K7AntiVirus | Spyware ( 005ea4a61 ) |
| K7GW | Spyware ( 005ea4a61 ) |
| Lionic | Trojan.Win32.SideWinder.4!c |
| MaxSecure | Trojan.Malware.328690006.susgen |
| MicroWorld-eScan | Trojan.GenericKD.80169967 |
| Microsoft | Trojan:Win32/Kepavll!rfn |
| Paloalto | generic.ml |
| Panda | Trj/PhxBzA.A |
| Rising | Spyware.Agent!8.C6 (KTSE) |
| Sangfor | Spyware.Win64.Agent.V595 |
| Skyhigh | BehavesLike.Win64.Injector.th |
| Sophos | Mal/Generic-S |
| Tencent | Win64.Trojan.Sidewinder.Ozfl |
| TrellixENS | Artemis!4A83420375C5 |
| TrendMicro | Trojan.Win64.SIDEWINDER.TL0101EM26ZZ |
| TrendMicro-HouseCall | Trojan.Win64.SIDEWINDER.TL0101EM26ZZ |
| VIPRE | Trojan.GenericKD.80169967 |
| Varist | W64/ABmTrojan.XKXO-6023 |
| VirIT | Trojan.Win64.Genus.JQV |
| alibabacloud | Trojan[spy]:Win/SideWinder.gyf |
| huorong | Trojan/Generic!C90A047834EB1FBD |