a5f629e62e8012c0ead81b462bc05ec9d20395af3121f87961f9d2dfde908895

Classification: Malicious

a5f629e62e8012c0ead81b462bc05ec9d20395af3121f87961f9d2dfde908895 is a trojan (Windows executable, 615.0 KB). Detected by 53 antivirus engines.

Detection summary

  • 53 antivirus detections
  • 0 IDS alerts
  • 29 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: ROKRAT (S0240)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-07-27 08:45:04 2026-09-06 20:45:05 malicious-activity
RokRAT ThreatFox Abuse.ch 2024-07-27 19:50:20 2024-07-29 19:18:37 S0240 ROKRAT
XenoRAT MalwareBazaar Abuse.ch 2024-07-27 08:20:22 2024-07-27 08:20:22 malicious-activity

Tags

evasive win.rokrat dogcall

Sample information

Filenames
a5f629e62e8012c0ead81b462bc05ec9d20395af3121f87961f9d2dfde908895, 88696cf17417a2339b63f9452404c839
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
629724 bytes
MD5
88696cf17417a2339b63f9452404c839
SHA-1
2123ca0e3764ba65e421d3b5dd7453da955d36f2
SHA-256
a5f629e62e8012c0ead81b462bc05ec9d20395af3121f87961f9d2dfde908895
First indexed
2024-07-27 08:26:42
Last updated
2026-09-21 15:13:46

Antivirus detections

EngineDetection
ALYacTrojan.Uztuby.37
APEXMalicious
BitDefenderTrojan.Uztuby.37
BkavW32.AIDetectMalware
CrowdStrikewin/malicious_confidence_70% (W)
Cybereasonmalicious.17417a
CylanceUnsafe
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
Elasticmalicious (high confidence)
EmsisoftTrojan.Uztuby.37 (B)
FireEyeGeneric.mg.88696cf17417a233
FortinetBAT/Runner.EMTH!tr
GDataTrojan.Uztuby.37
KasperskyUDS:Trojan.Win32.Injuke
KingsoftWin32.Troj.Unknown.a
LionicTrojan.Win32.Uztuby.4!c
MalwarebytesGeneric.Malware.AI.DDS
McAfeeArtemis!88696CF17417
McAfeeDti!A5F629E62E80
MicroWorld-eScanTrojan.Uztuby.37
Paloaltogeneric.ml
SangforTrojan.Win32.Agent.Vedx
SophosGeneric ML PUA (PUA)
VIPRETrojan.Uztuby.37
VaristW32/Runner.L.gen!Eldorado
ZoneAlarmUDS:Trojan.Win32.Injuke
huorongTrojan/BAT.Starter.am
AVGWin32:Malware-gen
AlibabaTrojan:Win32/Injuke.d6c31c06
Antiy-AVLTrojan/Win32.Injuke
AvastWin32:Malware-gen
CTXexe.trojan.injuke
CrowdStrikewin/malicious_confidence_100% (W)
K7AntiVirusRiskware ( 00584baa1 )
K7GWRiskware ( 00584baa1 )
KasperskyTrojan.Win32.Injuke.oejb
KingsoftWin32.Trojan.Injuke.oejb
LionicTrojan.Win32.Injuke.16!c
MalwarebytesMalware.AI.537430812
MaxSecureTrojan.Malware.273210960.susgen
MicrosoftTrojan:MSIL/XenoRat!rfn
PandaTrj/Agent.SRT
RisingTrojan.Generic!8.C3 (CLOUD)
SkyhighBehavesLike.Win32.Dropper.jc
SophosMal/Generic-S
SymantecTrojan.Gen.MBT
TencentWin32.Trojan.Injuke.Hflw
TrellixENSArtemis!88696CF17417
VBA32Backdoor.XenoRAT
VirITTrojan.Win32.RarDrp.GZV
XcitiumMalware@#3johfqmlr4v67
alibabacloudTrojan:Win/XenoRat.RXF2XJC

Network contacts

45.66.231.63

Process list

NameCommand line
88696cf17417a2339b63f9452404c839.exe
cmd.exe/c ""%APPDATA%\eystsdf.cmd" "
efthfxj.sfx.exe-pgtrfdewscbsdyethnymkdesppodtyuhngfszafugyRhvqxsdfHbgnmeG -d%USERPROFILE%\AppData\Roaming
efthfxj.exe
efthfxj.exe
efthfxj.exe
efthfxj.exe
efthfxj.exe
efthfxj.exe
efthfxj.exe
efthfxj.exe
schtasks.exe/Create /TN "HDdisplay" /XML "%TEMP%\tmpEC52.tmp" /F
efthfxj.exe
efthfxj.exe
WerFault.exe-u -p 5988 -s 4
88696cf17417a2339b63f9452404c839.exe
cmd.exe%WINDIR%\system32\cmd.exe /c ""%APPDATA%\eystsdf.cmd" "
efthfxj.sfx.exe-pgtrfdewscbsdyethnymkdesppodtyuhngfszafugyRhvqxsdfHbgnmeG -d%USERPROFILE%\AppData\Roaming
efthfxj.exe
efthfxj.exe
efthfxj.exe
efthfxj.exe
efthfxj.exe
efthfxj.exe
efthfxj.exe
efthfxj.exe
schtasks.exe/Create /TN "HDdisplay" /XML "%TEMP%\tmp97DE.tmp" /F
efthfxj.exe
efthfxj.exe