8116bc1cc5a9952d53a2b5a35956c631c45feb96a82316444cf287ed9a18f81d

Classification: Malicious

8116bc1cc5a9952d53a2b5a35956c631c45feb96a82316444cf287ed9a18f81d is a malicious file sample. Reported by 2 threat sources, last seen 2026-09-02.

Detection summary

  • 53 antivirus detections
  • 1 IDS alerts
  • 47 processes observed
  • 2 contacted hosts
  • 2 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-03-18 07:00:03 2026-09-02 16:45:05 malicious-activity
DCRat MalwareBazaar Abuse.ch 2024-03-18 06:25:05 2024-03-18 06:25:05 malicious-activity

Tags

evasive windows-server-utility rat

Sample information

Filenames
8116bc1cc5a9952d53a2b5a35956c631c45feb96a82316444cf287ed9a18f81d, 2b287961fc264bf9c109d26d679dc701.exe
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
1171456 bytes
MD5
2b287961fc264bf9c109d26d679dc701
SHA-1
75d383800827417273811b0eb755c4f78484f6ee
SHA-256
8116bc1cc5a9952d53a2b5a35956c631c45feb96a82316444cf287ed9a18f81d
First indexed
2024-03-18 06:43:34
Last updated
2026-09-02 16:45:05

Antivirus detections

EngineDetection
ALYacGen:Variant.Ransom.Prometheus.2
APEXMalicious
Acronissuspicious
AhnLab-V3Trojan/Win.FUJL.C5119684
AlibabaBackdoor:MSIL/DCRat.6968fad5
ArcabitTrojan.Ransom.Prometheus.2
AviraHEUR/AGEN.1323984
BitDefenderGen:Variant.Ransom.Prometheus.2
BitDefenderThetaGen:NN.ZemsilF.36802.hr0@aaBsQQni
BkavW32.AIDetectMalware.CS
CAT-QuickHealTrojan.DCRat.S29707587
CrowdStrikewin/malicious_confidence_100% (W)
Cybereasonmalicious.1fc264
Cylanceunsafe
DeepInstinctMALICIOUS
DrWebTrojan.PWS.StealerNET.124
ESET-NOD32a variant of MSIL/Spy.Agent.DTP
Elasticmalicious (high confidence)
EmsisoftGen:Variant.Ransom.Prometheus.2 (B)
F-SecureHeuristic.HEUR/AGEN.1323984
FireEyeGeneric.mg.2b287961fc264bf9
FortinetMSIL/Agent.DVA!tr
GDataGen:Variant.Ransom.Prometheus.2
GoogleDetected
GridinsoftTrojan.Win32.Agent.sa
IkarusTrojan.MSIL.Crypt
K7AntiVirusSpyware ( 0058ebd51 )
K7GWSpyware ( 0058ebd51 )
KasperskyHEUR:Backdoor.MSIL.DCRat.gen
Kingsoftmalware.kb.c.997
LionicTrojan.Win32.DCRat.m!c
MAXmalware (ai score=82)
MalwarebytesGeneric.Malware.AI.DDS
MaxSecureTrojan.Malware.300983.susgen
MicroWorld-eScanGen:Variant.Ransom.Prometheus.2
NANO-AntivirusTrojan.Win32.DCRat.kknkty
PandaTrj/GdSda.A
RisingBackdoor.DcRat!8.129D9 (CLOUD)
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.th
SophosTroj/DCRat-N
SymantecML.Attribute.HighConfidence
TencentTrojan.Msil.Dcrat.xa
TrendMicroTROJ_GEN.R002C0DCD24
TrendMicro-HouseCallTROJ_GEN.R002C0DCD24
VIPREGen:Variant.Ransom.Prometheus.2
VaristW32/MSIL_Agent.LQ.gen!Eldorado
ViRobotTrojan.Win.Z.Ransom.1171456
ZillyaTrojan.BasicGen.Win32.4
ZoneAlarmHEUR:Backdoor.MSIL.DCRat.gen
alibabacloudBackdoor:MSIL/Dcrat.A
tehtrisGeneric.Malware

Network contacts

141.8.192.193 34.117.186.192

DNS requests

a0929875.xsph.ru ipinfo.io

Process list

NameCommand line
2b287961fc264bf9c109d26d679dc701.exe
RuntimeBroker.exe
schtasks.exe/create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\fontdrvhost.exe'" /f
schtasks.exe/create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\fontdrvhost.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\fontdrvhost.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\sihost.exe'" /f
schtasks.exe/create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\sihost.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\sihost.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'%PROGRAMFILES%\(x86)\Microsoft.NET\RuntimeBroker.exe'" /f
schtasks.exe/create /tn "RuntimeBroker" /sc ONLOGON /tr "'%PROGRAMFILES%\(x86)\Microsoft.NET\RuntimeBroker.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'%PROGRAMFILES%\(x86)\Microsoft.NET\RuntimeBroker.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "ctfmonc" /sc MINUTE /mo 9 /tr "'C:\tempdir\ctfmon.exe'" /f
schtasks.exe/create /tn "ctfmon" /sc ONLOGON /tr "'C:\tempdir\ctfmon.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "ctfmonc" /sc MINUTE /mo 11 /tr "'C:\tempdir\ctfmon.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "IdleI" /sc MINUTE /mo 12 /tr "'%PROGRAMFILES%\WindowsPowerShell\Configuration\Registration\Idle.exe'" /f
schtasks.exe/create /tn "Idle" /sc ONLOGON /tr "'%PROGRAMFILES%\WindowsPowerShell\Configuration\Registration\Idle.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "IdleI" /sc MINUTE /mo 6 /tr "'%PROGRAMFILES%\WindowsPowerShell\Configuration\Registration\Idle.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Recovery\wininit.exe'" /f
schtasks.exe/create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\wininit.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\wininit.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\sppsvc.exe'" /f
schtasks.exe/create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\sppsvc.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\sppsvc.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\RuntimeBroker.exe'" /f
schtasks.exe/create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\RuntimeBroker.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\RuntimeBroker.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /f
schtasks.exe/create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\WmiPrvSE.exe'" /rl HIGHEST /f
schtasks.exe/create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'%PROGRAMFILES%\Uninstall Information\RuntimeBroker.exe'" /f