bfa4248005947726368f38380aab0158.exe

Classification: Malicious

bfa4248005947726368f38380aab0158.exe is a malicious file sample. Linked to Runningrat malware. Reported by 2 threat sources, last seen 2024-10-06.

Detection summary

  • 61 antivirus detections
  • 0 IDS alerts
  • 4 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: RUNNINGRAT (S0253)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-10-06 18:45:04 2024-10-06 19:30:39
RunningRAT MalwareBazaar Abuse.ch 2024-10-06 18:32:21 2024-10-06 18:32:21 malicious-activity S0253 RunningRAT

Sample information

Filenames
bfa4248005947726368f38380aab0158.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
49152 bytes
MD5
bfa4248005947726368f38380aab0158
SHA-1
bf5d8ea3d634bd1b7ec164a2e3659c7ba8f96148
SHA-256
a4cdb56a6b905ad47a796da718a187e862fee0e713755f97cc197838f3111e28
First indexed
2024-10-06 18:34:46
Last updated
2026-03-26 06:31:39

Antivirus detections

EngineDetection
APEXMalicious
AVGWin32:DropperX-gen [Drp]
AhnLab-V3Trojan/Win32.Agent.R128989
Antiy-AVLTrojan/Win32.Farfli
ArcabitTrojan.RI.1
AvastWin32:DropperX-gen [Drp]
AviraTR/AD.Farfli.qqkhu
BitDefenderGen:Heur.RI.1
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.Younglotus.20397
CTXexe.unknown.generic
ClamAVWin.Dropper.Gh0stRAT-7073897-1
CrowdStrikewin/malicious_confidence_90% (D)
CylanceUnsafe
CynetMalicious (score: 99)
DeepInstinctMALICIOUS
DrWebTrojan.DownLoader12.47777
ESET-NOD32Win32/Farfli.BGW
Elasticmalicious (high confidence)
EmsisoftGen:Heur.RI.1 (B)
F-SecureTrojan.TR/AD.Farfli.qqkhu
FireEyeGeneric.mg.bfa4248005947726
FortinetW32/Farfli.BGW!tr
GDataGen:Heur.RI.1
GoogleDetected
GridinsoftTrojan.Win32.Agent.vl!n
IkarusTrojan.Win32.Farfli
JiangminTrojan/YoungLotus.e
K7AntiVirusTrojan ( 0055e3e41 )
K7GWTrojan ( 0055e3e41 )
KasperskyTrojan.Win32.YoungLotus.t
Kingsoftmalware.kb.a.971
MalwarebytesMalware.AI.4194114185
MaxSecureTrojan.Malware.8167493.susgen
McAfeeBackDoor-FCWQ!BFA424800594
McAfeeDti!A4CDB56A6B90
MicroWorld-eScanGen:Heur.RI.1
MicrosoftBackdoor:Win32/Venik!pz
NANO-AntivirusTrojan.Win32.YoungLotus.dpanmc
PandaTrj/Genetic.gen
RisingTrojan.Farfli!1.C639 (KTSE)
SUPERAntiSpywareTrojan.Agent/Gen-Zusy
SkyhighBackDoor-FCWQ!BFA424800594
SophosMal/Generic-S
SymantecSMG.Heur!gen
TencentMalware.Win32.Gencirc.10b39405
Trapminemalicious.moderate.ml.score
TrendMicroBKDR_ZEGOST.SM29
TrendMicro-HouseCallBKDR_ZEGOST.SM29
VBA32BScope.Backdoor.Caphaw
VIPREGen:Heur.RI.1
VaristW32/S-0f55ee81!Eldorado
VirITBackdoor.Win32.Generic.JUY
WebrootTrojan.Younglotus
XcitiumTrojWare.Win32.YoungLotus.TCM@5ruomd
YandexTrojan.GenAsa!BZKdUv1dR3c
ZillyaTrojan.YoungLotus.Win32.4
ZoneAlarmTrojan.Win32.YoungLotus.t
ZonerTrojan.Win32.97590
alibabacloudWorm:Win/Farfli.ba5c7bd9
huorongBackdoor/Farfli.bn

Network contacts

119.29.18.61

Process list

NameCommand line
bfa4248005947726368f38380aab0158.exe
cmd.exe/c ping 127.0.0.1 -n 1 && del /f/q "C:\bfa4248005947726368f38380aab0158.exe"
PING.EXEping 127.0.0.1 -n 1
SySyaus.exe%WINDIR%\system32\SySyaus.exe "%ALLUSERSPROFILE%\application data\908871593.dll",MainThread