rftg.msi

Classification: Malicious

rftg.msi is a malicious file sample. Linked to Bitter activity. Reported by 1 threat source, last seen 2022-05-13. Detected by 32 antivirus engines.

Detection summary

  • 32 antivirus detections
  • 0 IDS alerts
  • 0 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: BITTER (G1002)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Bitter MalwareBazaar Abuse.ch 2022-05-13 08:17:30 2022-05-13 08:17:30 malicious-activity G1002 BITTER
Generic.Malware MalwareBazaar Abuse.ch 2022-05-13 08:17:30 2022-05-13 08:17:30 malicious-activity

Sample information

Filenames
rftg.msi
File type
application/x-msi
MD5
72ff5729200a86d7d0e83dbfca87721b
SHA-1
272cf1e2c08f3ea4efd6b94bc9940f7c9c72aaf4
SHA-256
17b11e00f1fe31caeaa269e5e54c5ff0fe2a8a5d5cae79718cd4c3ca64e5b0a4
First indexed
2022-05-13 09:15:03
Last updated
2026-04-04 18:53:29

Antivirus detections

EngineDetection
LionicTrojan.Win32.Agent.a!c
ClamAVWin.Downloader.ZxxZ-9944378-0
McAfeeTrojan-FTXR!59B043A91301
SangforTrojan.Win32.Agent.gen
K7AntiVirusTrojan ( 005916701 )
K7GWTrojan ( 005916701 )
CyrenABRisk.GXNS-8
SymantecTrojan.Gen.2
ESET-NOD32a variant of Win32/TrojanDownloader.Small.BJH
TrendMicro-HouseCallTROJ_GEN.R002C0DE422
AvastWin32:Trojan-gen
KasperskyHEUR:Trojan-Downloader.Win32.Agent.gen
BitDefenderTrojan.GenericKD.49018128
MicroWorld-eScanTrojan.GenericKD.49018128
RisingDownloader.Agent!8.B23 (CLOUD)
Ad-AwareTrojan.GenericKD.49018128
SophosMal/Generic-S
ZillyaDownloader.Agent.Win32.432146
TrendMicroTROJ_GEN.R002C0DE422
McAfee-GW-EditionTrojan-FTXR!59B043A91301
FireEyeTrojan.GenericKD.49018128
EmsisoftTrojan.GenericKD.49018128 (B)
GDataTrojan.GenericKD.49018128
MAXmalware (ai score=80)
KingsoftWin32.Troj.Undef.(kcloud)
ArcabitTrojan.Doina.D5A21
MicrosoftTrojanDownloader:Win32/FraudLoad.AN!MTB
VBA32BScope.TrojanDownloader.Agent
ALYacGen:Variant.Doina.23073
IkarusTrojan-Downloader.Win32.Small
FortinetW32/Agent!tr.dldr
AVGWin32:Trojan-gen