RIP_YOUR_PC_LOL.exe
Classification: Malicious
RIP_YOUR_PC_LOL.exe is a trojan (Windows executable, 22.5 MB). Flagged by 85% of antivirus engines (79 detections). Linked to Njrat, Dcrat malware.
Detection summary
- 79 antivirus detections (85% detection ratio)
- 1 IDS alerts
- 49 processes observed
- 6 contacted hosts
- 5 DNS requests
MITRE ATT&CK associations
Malware families: NJRAT (S0385) DCRAT (S9017)
Intrusion sets: APT37 (G0067)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| DCRat | ThreatFox Abuse.ch | 2024-07-22 02:54:43 | 2024-07-24 02:18:54 | S9017 DCRAT | |
| Apt37 | Maltiverse | 2023-07-04 04:28:51 | 2023-07-05 20:50:54 | malicious-activity | G0067 APT37 |
| Generic Malware | Hybrid-Analysis | 2023-06-28 15:15:05 | 2023-06-28 15:15:05 | ||
| njrat | MalwareBazaar Abuse.ch | 2022-03-08 16:52:07 | 2022-03-08 16:52:07 | malicious-activity | S0385 njRAT |
Tags
apt banker emotet evasive hawkeye infostealer keylogger nanocore qakbot spyware wanacrypt0r wannacry wcry windows-server-utility win.dcrat darkcrystal ratSample information
- Filenames
- RIP_YOUR_PC_LOL.exe
- File type
- PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
- Size
- 23633920 bytes
- MD5
52867174362410d63215d78e708103ea- SHA-1
7ae4e1048e4463a4201bdeaf224c5b6face681bf- SHA-256
37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a- First indexed
- 2022-03-08 18:15:14
- Last updated
- 2026-09-03 12:42:33
Antivirus detections
| Engine | Detection |
|---|---|
| Elastic | malicious (high confidence) |
| FireEye | Generic.mg.52867174362410d6 |
| CAT-QuickHeal | TrojanSpy.Golroted.B3 |
| McAfee | Packed-PM!528671743624 |
| Cylance | Unsafe |
| Zillya | Trojan.Kryptik.Win32.3651801 |
| Sangfor | Virus.Win32.Save.a |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Alibaba | Malware:Win32/Dorpal.ali1000029 |
| K7GW | Trojan ( 0053e65b1 ) |
| K7AntiVirus | Trojan ( 0053e65b1 ) |
| Baidu | Win32.Trojan-Spy.KeyLogger.b |
| Cyren | W32/MSIL_Troj.C.gen!Eldorado |
| ESET-NOD32 | a variant of MSIL/TrojanDropper.Agent.FKI |
| APEX | Malicious |
| Avast | MSIL:Stealer-BH [PUP] |
| ClamAV | Win.Trojan.NanoCore-9852758-0 |
| Kaspersky | Trojan-PSW.Win32.Stealer.xuv |
| Tencent | Msil.Trojan-dropper.Agent.Sunu |
| Comodo | TrojWare.MSIL.Boilod.MFC@7j93d6 |
| DrWeb | BackDoor.Quasar.1 |
| VIPRE | Trojan-Spy.MSIL.Golroted.a (v) |
| TrendMicro | TROJ_GEN.R002C0DLC21 |
| McAfee-GW-Edition | Packed-PM!528671743624 |
| Trapmine | malicious.high.ml.score |
| Sophos | Generic Reputation PUA (PUA) |
| Paloalto | generic.ml |
| GData | Win32.Trojan.Agent.1BAY80 |
| Avira | TR/AD.MExecute.lzrac |
| Antiy-AVL | Trojan/Generic.ASCommon.FA |
| Kingsoft | Win32.Hack.Undef.(kcloud) |
| Gridinsoft | PWS.Win32.Gen.vl!ni |
| Microsoft | Trojan:MSIL/Remcos.PH!MTB |
| AhnLab-V3 | Malware/Win32.RL_Generic.C4252852 |
| VBA32 | Trojan.MSIL.gen.11 |
| Malwarebytes | Malware.AI.320336464 |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DLC21 |
| Rising | Spyware.HawkEye!1.C9B0 (CLASSIC) |
| Yandex | Trojan.Kryptik!onqmvGlwXdM |
| SentinelOne | Static AI - Malicious PE |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | MSIL/Injector.PE!tr |
| AVG | MSIL:Stealer-BH [PUP] |
| Cybereason | malicious.48e446 |
| Panda | Trj/CI.A |
| Bkav | W32.Common.2AC78DEB |
| Lionic | Trojan.Win32.Stealer.12!c |
| Elastic | Windows.Trojan.Asyncrat |
| MicroWorld-eScan | Trojan.Agent.FUUR |
| Cylance | unsafe |
| Sangfor | Trojan.Win32.Save.BlackMoon |
| K7GW | Trojan ( 005978df1 ) |
| K7AntiVirus | Trojan ( 005978df1 ) |
| Symantec | ML.Attribute.HighConfidence |
| BitDefender | Trojan.Agent.FUUR |
| Sophos | Troj/Reflekt-B |
| F-Secure | PrivacyRisk.SPR/Tool.MailPassView.473 |
| VIPRE | Trojan.Agent.FUUR |
| TrendMicro | TROJ_GEN.R002C0DDC23 |
| Emsisoft | Trojan.Agent.FUUR (B) |
| Ikarus | Trojan.MSIL.Krypt |
| Jiangmin | Trojan.MSIL.amnyg |
| Webroot | W32.Trojan.Dropper |
| Detected | |
| Antiy-AVL | Trojan/Win32.FlyStudio.a |
| Microsoft | Trojan:Win32/Vindor!pz |
| Xcitium | TrojWare.MSIL.Boilod.MFC@7j93d6 |
| Arcabit | Trojan.Agent.FUUR |
| ZoneAlarm | Trojan.Win32.Antavmu.atoy |
| GData | Trojan.Agent.FUUR |
| Cynet | Malicious (score: 99) |
| Acronis | suspicious |
| VBA32 | OScope.Backdoor.MSIL.Crysan |
| ALYac | Trojan.Agent.FUUR |
| MAX | malware (ai score=100) |
| Malwarebytes | Generic.Malware.AI.DDS |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DDC23 |
| Tencent | Trojan.Win32.Bladabindi.16000442 |
| DeepInstinct | MALICIOUS |
Network contacts
173.231.16.76 172.98.92.42 59.56.110.231 92.63.107.12 204.11.56.48 199.59.243.223
DNS requests
22ssh.com api.ipify.org kazya1.hopto.org ww6.22ssh.com yabynennet.xyz
Process list
| Name | Command line |
|---|---|
| RIP_YOUR_PC_LOL.exe | |
| healastounding.exe | |
| test.exe | |
| gay.exe | |
| mediaget.exe | |
| netsh.exe | netsh firewall add allowedprogram "%APPDATA%\mediaget.exe" "mediaget.exe" ENABLE |
| Opus.exe | |
| schtasks.exe | /create /f /tn "SCSI Service" /xml "%TEMP%\tmpD32.tmp" |
| schtasks.exe | /create /f /tn "SCSI Service Task" /xml "%TEMP%\tmp2C83.tmp" |
| aaa.exe | |
| aaa.exe | |
| cmd.exe | %WINDIR%\system32\cmd.exe /c ""%APPDATA%\aaa.exe" " |
| 8f1c8b40c7be588389a8d382040b23bb.exe | |
| WerFault.exe | -u -p 4328 -s 792 |
| WerFault.exe | -u -p 4328 -s 792 |
| WerFault.exe | -u -p 4328 -s 380 |
| 4.exe | |
| 3.exe | |
| winlogon.exe | |
| a.exe | |
| Pluto Panel.exe | |
| dw20.exe | -x -s 904 |
| 0fd7de5367376231a788872005d7ed4f.exe | |
| 0fd7de5367376231a788872005d7ed4f.exe | |
| 22.exe | |
| netsh.exe | netsh ipsec static add policy name=Block |
| netsh.exe | netsh ipsec static add filterlist name=Filter1 |
| netsh.exe | netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP |
| netsh.exe | netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP |
| netsh.exe | netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP |