73096690ffc9dad9df868fa94030607f4361bf9cd4e6a0f7e940d8696d758f4c

Classification: Malicious

73096690ffc9dad9df868fa94030607f4361bf9cd4e6a0f7e940d8696d758f4c is a trojan (application/x-dosexec, 32.5 KB). Linked to Runningrat malware.

Detection summary

  • 53 antivirus detections (74% detection ratio)
  • 0 IDS alerts
  • 4 processes observed
  • 1 contacted hosts
  • 1 DNS requests

MITRE ATT&CK associations

Malware families: RUNNINGRAT (S0253)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Backdoor VM-Ray 2023-01-16 10:19:59 2023-01-16 10:19:59
Generic Malware Hybrid-Analysis 2023-01-16 10:00:04 2023-01-16 10:00:04
RunningRAT MalwareBazaar Abuse.ch 2023-01-16 09:36:21 2023-01-16 09:36:21 malicious-activity S0253 RunningRAT

Sample information

Filenames
73096690ffc9dad9df868fa94030607f4361bf9cd4e6a0f7e940d8696d758f4c.exe, 2e0699c149b6e8f5052c9ca681b31483.exe
File type
application/x-dosexec
Size
33280 bytes
MD5
2e0699c149b6e8f5052c9ca681b31483
SHA-1
d92c92fe190de3e2eacbe2c7ca0c379af8e06ec4
SHA-256
73096690ffc9dad9df868fa94030607f4361bf9cd4e6a0f7e940d8696d758f4c
First indexed
2023-01-16 09:46:49
Last updated
2025-10-12 13:23:18

Antivirus detections

EngineDetection
Elasticmalicious (moderate confidence)
MicroWorld-eScanGen:Heur.RI.1
ClamAVWin.Malware.Siscos-6993581-0
FireEyeGeneric.mg.2e0699c149b6e8f5
CAT-QuickHealTrojan.SiscosRI.S8512495
McAfeeGenericRXIX-IO!A4671DBD9811
CylanceUnsafe
VIPREGen:Heur.RI.1
K7AntiVirusTrojan ( 00522d7f1 )
K7GWTrojan ( 00522d7f1 )
Cybereasonmalicious.149b6e
CyrenW32/Siscos.E.gen!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Farfli.CEN
APEXMalicious
CynetMalicious (score: 100)
KasperskyTrojan.Win32.Siscos.wbm
BitDefenderGen:Heur.RI.1
NANO-AntivirusTrojan.Win32.Siscos.enrcbv
SUPERAntiSpywareBackdoor.Farfli/Variant
AvastWin32:TrojanX-gen [Trj]
TencentTrojan.Win32.Siscos.za
TACHYONTrojan/W32.Siscos.110592.C
EmsisoftGen:Heur.RI.1 (B)
F-SecureHeuristic.HEUR/AGEN.1234095
DrWebTrojan.DownLoader23.39271
ZillyaTrojan.Siscos.Win32.5713
McAfee-GW-EditionGenericRXIX-IO!A4671DBD9811
Trapminemalicious.moderate.ml.score
SophosTroj/AutoG-AD
IkarusTrojan.Win32.Farfli
GDataGen:Heur.RI.1
JiangminTrojan.Siscos.ks
AviraHEUR/AGEN.1234095
Antiy-AVLTrojan/Win32.SelfDel
GridinsoftTrojan.Win32.Agent.vb!n
XcitiumTrojWare.Win32.GameThief.Magania.~NWABU@18g2sq
ArcabitTrojan.RI.1
ZoneAlarmTrojan.Win32.Siscos.wbm
MicrosoftTrojan:Win32/Sabsik.TE.B!ml
GoogleDetected
AhnLab-V3Trojan/Win32.RL_Siscos.R302641
BitDefenderThetaGen:NN.ZexaF.36212.cmKfam7RHxce
ALYacGen:Heur.RI.1
MAXmalware (ai score=82)
VBA32BScope.Trojan.Siscos
MalwarebytesGeneric.Crypt.Trojan.Malicious.DDS
RisingBackdoor.Venik!8.11E (TFE:5:Uqd4uAhaXbC)
YandexTrojan.GenAsa!G5Cq9PqIIJA
SentinelOneStatic AI - Suspicious PE
FortinetW32/Farfli.CEN!tr
AVGWin32:TrojanX-gen [Trj]
CrowdStrikewin/malicious_confidence_70% (D)

Network contacts

222.92.77.166

DNS requests

sky.hobuff.info

Process list

NameCommand line
73096690ffc9dad9df868fa94030607f4361bf9cd4e6a0f7e940d8696d758f4c.exe
cmd.exe/c ping 127.0.0.1 -n 1 && del /f/q "C:\73096690ffc9dad9df868fa94030607f4361bf9cd4e6a0f7e940d8696d758f4c.exe"
PING.EXEping 127.0.0.1 -n 1
serivecs.exe"%WINDIR%\system32\907385687.dll",MainThread