Classification: Malicious
fechas de pago.scr is a trojan (Windows executable, 240.0 KB). Detected by 39 antivirus engines. Linked to Rokrat malware. 55 sightings, last seen 2026-08-25.
Detection summary
- 39 antivirus detections
- 1 IDS alerts
- 11 processes observed
- 1 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Hybrid-Analysis |
2024-07-04 11:45:04 |
2026-08-25 11:45:07 |
malicious-activity
|
|
| RokRAT |
ThreatFox Abuse.ch |
2024-07-04 15:29:37 |
2024-07-06 15:21:57 |
|
S0240 ROKRAT
|
| XenoRAT |
MalwareBazaar Abuse.ch |
2024-07-04 11:37:53 |
2024-07-04 11:37:53 |
malicious-activity
|
|
Tags
evasive
win.rokrat
dogcall
Sample information
- Filenames
- 5fda36bec5b1d5ec526e5b044a6b30b7afa1d0d5465ffa7c470efc9358ebc4b5, fechas de pago.scr
- File type
- PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
- Size
- 245760 bytes
- MD5
bcc06a7faf92224142143e13eaf78cf1- SHA-1
0be4983558b5b48bf0b1a1ec129cb380939c84ae- SHA-256
5fda36bec5b1d5ec526e5b044a6b30b7afa1d0d5465ffa7c470efc9358ebc4b5- First indexed
- 2024-07-04 11:38:03
- Last updated
- 2026-10-05 21:51:23
Antivirus detections
| Engine | Detection |
|---|
| APEX | Malicious |
| AVG | Win32:TrojanX-gen [Trj] |
| AhnLab-V3 | Trojan/Win.Generic.C5643317 |
| Alibaba | TrojanPSW:MSIL/Stealer.806ee621 |
| Arcabit | Trojan.MSILHeracles.D29394 |
| Avast | Win32:TrojanX-gen [Trj] |
| Avira | HEUR/AGEN.1365826 |
| BitDefender | Gen:Variant.MSILHeracles.168852 |
| BitDefenderTheta | Gen:NN.ZemsilF.36808.pm0@auR7v8i |
| Bkav | W32.AIDetectMalware.CS |
| ClamAV | Win.Packed.Jalapeno-10031830-0 |
| CrowdStrike | win/malicious_confidence_90% (D) |
| Cybereason | malicious.faf922 |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.PackedNET.2928 |
| ESET-NOD32 | a variant of MSIL/Kryptik.AFFK |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Variant.MSILHeracles.168852 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1365826 |
| FireEye | Generic.mg.bcc06a7faf922241 |
| GData | Gen:Variant.MSILHeracles.168852 |
| Google | Detected |
| Ikarus | Trojan.MSIL.Crypt |
| Kaspersky | HEUR:Trojan-PSW.MSIL.Stealer.gen |
| Kingsoft | malware.kb.c.1000 |
| MAX | malware (ai score=87) |
| McAfeeD | Real Protect-LS!BCC06A7FAF92 |
| MicroWorld-eScan | Gen:Variant.MSILHeracles.168852 |
| Microsoft | Trojan:Win32/Leonem |
| Paloalto | generic.ml |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:76Tx+k+SVqkUUUlVdF+H6Q) |
| Sangfor | Suspicious.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Sophos | Generic ML PUA (PUA) |
| Symantec | ML.Attribute.HighConfidence |
| VIPRE | Gen:Variant.MSILHeracles.168852 |
| VirIT | Trojan.Win32.MSIL_Heur.A |
| ZoneAlarm | HEUR:Trojan-PSW.MSIL.Stealer.gen |
Process list
| Name | Command line |
|---|
| fechasdepago.scr.exe | |
| fechasdepago.scr.exe | |
| fechasdepago.scr.exe | |
| fechasdepago.scr.exe | |
| fechasdepago.scr.exe | |
| WerFault.exe | -u -p 1148 -s 72 |
| fechasdepago.scr.exe | |
| fechasdepago.scr.exe | |
| schtasks.exe | /Create /TN "dms" /XML "%TEMP%\tmpB5E6.tmp" /F |
| fechasdepago.scr.exe | |
| WerFault.exe | -pss -s 156 -p 1148 -ip 1148 |