5258282aa100642965f9ba334fbdf5c272f8ccaab5b295580b1f57581a7851ac

Classification: Malicious

5258282aa100642965f9ba334fbdf5c272f8ccaab5b295580b1f57581a7851ac is a trojan (Windows executable, 174.5 KB). Detected by 44 antivirus engines.

Detection summary

  • 44 antivirus detections
  • 1 IDS alerts
  • 10 processes observed
  • 2 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Malware families: SOMBRAT (S0615)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
SombRAT ThreatFox Abuse.ch 2024-05-13 16:34:18 2024-05-15 16:22:01 S0615 SombRAT
Generic Malware Hybrid-Analysis 2024-05-12 21:27:23 2024-05-12 23:30:06

Tags

evasive win.sombrat

Sample information

Filenames
49222F74975B5B76E75C066EADD93397.exe
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
178688 bytes
MD5
49222f74975b5b76e75c066eadd93397
SHA-1
d9a6be2d4244b60df847c590fee45f084269df2d
SHA-256
5258282aa100642965f9ba334fbdf5c272f8ccaab5b295580b1f57581a7851ac
First indexed
2024-05-12 21:08:24
Last updated
2026-10-03 06:18:43

Antivirus detections

EngineDetection
ALYacGen:Variant.Jalapeno.273
APEXMalicious
AVGWin32:MalwareX-gen [Trj]
AhnLab-V3Trojan/Win.Generic.C5340499
ArcabitTrojan.Jalapeno.273
AvastWin32:MalwareX-gen [Trj]
AviraHEUR/AGEN.1305503
BitDefenderGen:Variant.Jalapeno.273
BitDefenderThetaGen:NN.ZemsilF.36804.km0@aOXLh8c
BkavW32.AIDetectMalware.CS
CAT-QuickHealTrojan.MsilFC.S24736542
ClamAVWin.Packed.Razy-9807129-0
Cylanceunsafe
DeepInstinctMALICIOUS
DrWebTrojan.PWS.Stealer.32288
ESET-NOD32a variant of MSIL/GenKryptik.CVGY
ElasticWindows.Generic.Threat
EmsisoftGen:Variant.Jalapeno.273 (B)
F-SecureHeuristic.HEUR/AGEN.1305503
FireEyeGeneric.mg.49222f74975b5b76
FortinetMSIL/GenKryptik.CVGY!tr
GDataGen:Variant.Jalapeno.273
GoogleDetected
IkarusTrojan-Spy.RedLineStealer
KasperskyHEUR:Trojan.MSIL.Agent.gen
Kingsoftmalware.kb.c.1000
LionicTrojan.Win32.Agent.Y!c
MAXmalware (ai score=81)
MalwarebytesRedlineStealer.Spyware.Stealer.DDS
MaxSecureTrojan.Malware.121218.susgen
McAfeeGenericRXHC-TA!49222F74975B
MicroWorld-eScanGen:Variant.Jalapeno.273
MicrosoftPWS:MSIL/RedLine!atmn
RisingBackdoor.SectopRAT!1.DA27 (CLASSIC)
SangforSuspicious.Win32.Save.a
SkyhighBehavesLike.Win32.Generic.cm
SophosMal/Reline-B
SymantecML.Attribute.HighConfidence
TencentTrojan.MSIL.Agent.16000593
Trapminemalicious.moderate.ml.score
VBA32Trojan.MSIL.RedLine.Heur
VIPREGen:Variant.Jalapeno.273
VaristW32/Azorult.D.gen!Eldorado
ZoneAlarmHEUR:Trojan-PSW.MSIL.Reline.gen

Network contacts

85.114.96.11 172.67.75.172

DNS requests

api.ip.sb

Process list

NameCommand line
49222F74975B5B76E75C066EADD93397.exe
metin.exe
WerFault.exe-u -p 368 -s 1316
Metin2.exe
WerFault.exe-pss -s 464 -p 368 -ip 368
49222F74975B5B76E75C066EADD93397.exe
metin.exe
WerFault.exe-u -p 6308 -s 1212
Metin2.exe
WerFault.exe-pss -s 460 -p 6308 -ip 6308