829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c
Classification: Malicious
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c is a trojan (application/x-dosexec, 32.5 KB). Linked to Runningrat malware.
Detection summary
- 52 antivirus detections (77% detection ratio)
- 0 IDS alerts
- 4 processes observed
- 1 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Backdoor |
VM-Ray |
2023-02-27 02:20:08 |
2023-02-27 02:20:08 |
|
|
| Generic Malware |
Hybrid-Analysis |
2023-02-26 20:15:03 |
2023-02-26 20:15:03 |
|
|
| RunningRAT |
MalwareBazaar Abuse.ch |
2023-02-26 18:58:11 |
2023-02-26 18:58:11 |
|
S0253 RunningRAT
|
Sample information
- Filenames
- 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe, 6378a3a153dba78e21c4d7f96d4dfec0.exe
- File type
- application/x-dosexec
- Size
- 33280 bytes
- MD5
6378a3a153dba78e21c4d7f96d4dfec0- SHA-1
a5cd66f84195cdd90362c62746cfefeddc49ed6b- SHA-256
829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c- First indexed
- 2023-02-26 18:58:11
- Last updated
- 2025-10-15 10:04:13
Antivirus detections
| Engine | Detection |
|---|
| Lionic | Trojan.Win32.Siscos.4!c |
| MicroWorld-eScan | Gen:Heur.RI.1 |
| ClamAV | Win.Malware.Siscos-6993581-0 |
| FireEye | Generic.mg.6378a3a153dba78e |
| CAT-QuickHeal | Trojan.SiscosRI.S8512495 |
| ALYac | Gen:Heur.RI.1 |
| Malwarebytes | FarFli.Backdoor.Bot.DDS |
| Zillya | Trojan.Siscos.Win32.6058 |
| K7AntiVirus | Trojan ( 00522d7f1 ) |
| Alibaba | Backdoor:Win32/Farfli.90878f2a |
| K7GW | Trojan ( 00522d7f1 ) |
| CrowdStrike | win/malicious_confidence_90% (W) |
| Cyren | W32/Siscos.E.gen!Eldorado |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (moderate confidence) |
| ESET-NOD32 | Win32/Farfli.CEN |
| APEX | Malicious |
| Cynet | Malicious (score: 100) |
| Kaspersky | Trojan.Win32.Siscos.wbm |
| BitDefender | Gen:Heur.RI.1 |
| NANO-Antivirus | Trojan.Win32.Siscos.enrcbv |
| Avast | Win32:TrojanX-gen [Trj] |
| Tencent | Trojan.Win32.Siscos.za |
| TACHYON | Trojan/W32.Siscos.110592.C |
| Sophos | Troj/AutoG-AD |
| DrWeb | Trojan.DownLoader23.39271 |
| VIPRE | Gen:Heur.RI.1 |
| McAfee-GW-Edition | GenericRXIX-IO!4F8980ACDC05 |
| Trapmine | malicious.moderate.ml.score |
| Emsisoft | Gen:Heur.RI.1 (B) |
| SentinelOne | Static AI - Suspicious PE |
| Jiangmin | Trojan.Siscos.ks |
| Avira | HEUR/AGEN.1234095 |
| Antiy-AVL | Trojan/Win32.SelfDel |
| Gridinsoft | Trojan.Win32.Agent.vb!n |
| Xcitium | TrojWare.Win32.GameThief.Magania.~NWABU@18g2sq |
| Arcabit | Trojan.RI.1 |
| SUPERAntiSpyware | Backdoor.Farfli/Variant |
| GData | Win32.Trojan.Siscos.A |
| Google | Detected |
| AhnLab-V3 | Trojan/Win32.RL_Siscos.R302641 |
| McAfee | Artemis!6378A3A153DB |
| MAX | malware (ai score=87) |
| VBA32 | Trojan.Siscos |
| Rising | Backdoor.Venik!8.11E (TFE:5:Uqd4uAhaXbC) |
| Yandex | Trojan.GenAsa!G5Cq9PqIIJA |
| Ikarus | Trojan.Win32.Farfli |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | W32/Farfli.CEN!tr |
| BitDefenderTheta | Gen:NN.ZexaF.36276.cmKfa4Gr0Eke |
| AVG | Win32:TrojanX-gen [Trj] |
| Cybereason | malicious.153dba |
Process list
| Name | Command line |
|---|
| 829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe | |
| cmd.exe | /c ping 127.0.0.1 -n 1 && del /f/q "C:\829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe" |
| PING.EXE | ping 127.0.0.1 -n 1 |
| serivces.exe_SameAs_RUNDLL32.EXE | %WINDIR%\system32\serivces.exe "%WINDIR%\system32\907387328.dll",MainThread |