0x000700000001e6af-1
Classification: Malicious
0x000700000001e6af-1 is a trojan (application/x-dosexec). Detected by 67 antivirus engines. Linked to Rokrat malware.
Detection summary
- 67 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: ROKRAT (S0240)
Intrusion sets: APT37 (G0067)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| APT37 | MalwarePatrol | 2026-03-03 18:12:25 | 2026-03-03 18:12:25 | malicious-activity | G0067 APT37 |
| ROKRAT | MalwareBazaar Abuse.ch | 2025-08-06 06:31:53 | 2025-08-06 06:31:53 | malicious-activity | S0240 ROKRAT |
Tags
apt37 moldy pisces operation daybreak venus 121 g0067 reaper group ricochet chollima apt-c-28 red eyes group 123 inkysquid scarcruft atk4 operation erebusSample information
- Filenames
- 0x000700000001e6af-1
- File type
- application/x-dosexec
- MD5
d5fe744b9623a0cc7f0ef6464c5530da- SHA-1
b26a769254487129d64e1043a3eb3a9cbc5ac5fc- SHA-256
41d9b6d8cf0fff85bf35327d4b94db629cd9f754c487672911b7f701fe8c5539- First indexed
- 2025-08-06 07:19:13
- Last updated
- 2026-03-25 02:14:16
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Backdoor.Agent.status |
| AVG | Win32:MalwareX-gen [Misc] |
| AhnLab-V3 | Downloader/Win.Agent.C5777285 |
| Alibaba | TrojanSpy:Win32/RokRat.9c75eecb |
| Arcabit | Trojan.Fragtor.DD6A6A |
| Avast | Win32:MalwareX-gen [Misc] |
| Avira | TR/Spy.Agent.nkkyr |
| BitDefender | Gen:Variant.Fragtor.879210 |
| Bkav | W32.Common.F61B082A |
| CAT-QuickHeal | Trojan.Ghanarava.17543466115530da |
| CTX | dll.trojan.rokrat |
| CrowdStrike | win/malicious_confidence_60% (D) |
| Cylance | Unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| ESET-NOD32 | Win32/Spy.Agent.QIN |
| Elastic | malicious (moderate confidence) |
| Emsisoft | Gen:Variant.Fragtor.879210 (B) |
| F-Secure | Trojan.TR/Spy.Agent.nkkyr |
| Fortinet | W32/PossibleThreat |
| GData | Gen:Variant.Fragtor.879210 |
| Detected | |
| Gridinsoft | Susp.U.XOREncoded.sd!yf |
| Ikarus | Trojan.VMProtect |
| K7AntiVirus | Spyware ( 005c84be1 ) |
| K7GW | Spyware ( 005c84be1 ) |
| Kaspersky | Trojan.Win32.RokRat.n |
| Kingsoft | Win32.Trojan.RokRat.n |
| Lionic | Trojan.Win32.RokRat.4!c |
| Malwarebytes | Malware.AI.4149657788 |
| MaxSecure | Trojan.Malware.400475832.susgen |
| McAfeeD | ti!41D9B6D8CF0F |
| MicroWorld-eScan | Gen:Variant.Fragtor.879210 |
| Microsoft | Trojan:Win32/Casdet!rfn |
| NANO-Antivirus | Virus.Win32.Gen.ccmw |
| Paloalto | generic.ml |
| Rising | Trojan.Agent!1.12F70 (CLASSIC) |
| Sangfor | Spyware.Win32.Rokrat.Vv1p |
| Skyhigh | Artemis!Trojan |
| Sophos | Mal/Generic-S |
| Symantec | Trojan Horse |
| Tencent | Malware.Win32.Gencirc.14979827 |
| Trapmine | suspicious.low.ml.score |
| TrellixENS | Artemis!D5FE744B9623 |
| TrendMicro | TROJ_FRS.VSNTGN25 |
| TrendMicro-HouseCall | TROJ_FRS.VSNTGN25 |
| VIPRE | Gen:Variant.Fragtor.879210 |
| Varist | W32/ABTrojan.OCGX-0677 |
| Zillya | Trojan.Agent.Win32.4302926 |
| alibabacloud | Trojan[spy]:Win/RokRat.n |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Trojan.Ghanarava.17579639645530da |
| CrowdStrike | win/malicious_confidence_100% (W) |
| ESET-NOD32 | Win32/Spy.Agent.QIN trojan |
| Elastic | malicious (high confidence) |
| K7AntiVirus | Spyware ( 005d17831 ) |
| K7GW | Spyware ( 005d17831 ) |
| Malwarebytes | Malware.AI.2029653873 |
| Panda | Trj/PhxBzA.A |
| Sangfor | Spyware.Win32.Rokrat.Vxqi |
| Sophos | Troj/Krypt-ASX |
| TrendMicro | Trojan.Win32.FRS.VSNTGN25 |
| TrendMicro-HouseCall | Trojan.Win32.FRS.VSNTGN25 |
| Varist | W32/Trojan.IZRE-6009 |
| ZoneAlarm | Troj/Krypt-ASX |
| alibabacloud | Trojan[spy]:Win/Casdet.Gen |
| huorong | Trojan/Generic!C289E1796F846699 |