odeme tarihleri.scr

Classification: Malicious

odeme tarihleri.scr is a malicious file sample. Linked to Rokrat malware. Reported by 3 threat sources, last seen 2024-07-06.

Detection summary

  • 80 antivirus detections
  • 2 IDS alerts
  • 20 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: ROKRAT (S0240)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
RokRAT ThreatFox Abuse.ch 2024-07-04 15:29:18 2024-07-06 15:21:58 S0240 ROKRAT
Generic Malware Hybrid-Analysis 2024-07-04 12:00:03 2024-07-04 12:45:08
XenoRAT MalwareBazaar Abuse.ch 2024-07-04 11:41:26 2024-07-04 11:41:26 malicious-activity

Tags

evasive windows-server-utility win.rokrat dogcall

Sample information

Filenames
odeme tarihleri.scr
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
245760 bytes
MD5
bb4b3fd0c725a96ba871f77f9604fa69
SHA-1
0b3926a1a98b87938b94f8ffd511f7319a576990
SHA-256
c3e5a543f13e20484325ba5a08fd8993880f8282ed5a40e30c97fcf2aea91fa1
First indexed
2024-07-04 11:45:11
Last updated
2026-04-03 03:18:29

Antivirus detections

EngineDetection
ALYacGen:Variant.MSILHeracles.168852
APEXMalicious
AVGWin32:TrojanX-gen [Trj]
AhnLab-V3Trojan/Win.Generic.C5643317
ArcabitTrojan.MSILHeracles.D29394
AvastWin32:TrojanX-gen [Trj]
AviraHEUR/AGEN.1365826
BitDefenderGen:Variant.MSILHeracles.168852
BitDefenderThetaGen:NN.ZemsilF.36808.pm0@a0nKK5b
BkavW32.AIDetectMalware.CS
ClamAVWin.Packed.Jalapeno-10031830-0
CrowdStrikewin/malicious_confidence_90% (D)
Cybereasonmalicious.0c725a
CylanceUnsafe
DeepInstinctMALICIOUS
DrWebTrojan.PackedNET.2928
ESET-NOD32a variant of MSIL/Kryptik.AFFK
Elasticmalicious (high confidence)
EmsisoftGen:Variant.MSILHeracles.168852 (B)
F-SecureHeuristic.HEUR/AGEN.1365826
FireEyeGeneric.mg.bb4b3fd0c725a96b
FortinetMSIL/GenKryptik.FEDY!tr
GDataGen:Variant.MSILHeracles.168852
GoogleDetected
IkarusTrojan.MSIL.Crypt
KasperskyHEUR:Trojan-PSW.MSIL.Stealer.gen
Kingsoftmalware.kb.c.1000
MAXmalware (ai score=83)
MaxSecureTrojan.Malware.300983.susgen
McAfeeDReal Protect-LS!BB4B3FD0C725
MicroWorld-eScanGen:Variant.MSILHeracles.168852
MicrosoftTrojan:Win32/Wacatac.B!ml
Paloaltogeneric.ml
RisingMalware.Obfus/[email protected] (RDM.MSIL2:DaJwJW6HsZ1S+dRqZx9yzQ)
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SophosGeneric ML PUA (PUA)
SymantecML.Attribute.HighConfidence
VIPREGen:Variant.MSILHeracles.168852
VirITTrojan.Win32.MSIL_Heur.A
ZoneAlarmHEUR:Trojan-PSW.MSIL.Stealer.gen
ALYacGen:Variant.Jalapeno.18019
AVGWin32:MalwareX-gen [Trj]
AlibabaTrojanPSW:MSIL/XenoRat.8963d293
ArcabitTrojan.Jalapeno.D4663
AvastWin32:MalwareX-gen [Trj]
AviraHEUR/AGEN.1378650
BitDefenderGen:Variant.Jalapeno.18019
BkavW32.Common.7D13E8D4
CTXexe.trojan.msil
CrowdStrikewin/malicious_confidence_100% (W)
ESET-NOD32MSIL/Kryptik.AFFK trojan
EmsisoftGen:Variant.Jalapeno.18019 (B)
F-SecureHeuristic.HEUR/AGEN.1378650
GDataGen:Variant.Jalapeno.18019
K7AntiVirusTrojan ( 700000201 )
K7GWTrojan ( 700000201 )
KasperskyHEUR:Trojan.MSIL.Xeno.gen
KingsoftMSIL.Trojan-PSW.Stealer.gen
LionicTrojan.Win32.XenoRat.4!c
MalwarebytesTrojan.Crypt.MSIL
MaxSecureTrojan.Malware.74396735.susgen
McAfeeDTrojan:Win/Heapoverride.EAA
MicroWorld-eScanGen:Variant.Jalapeno.18019
MicrosoftTrojan:MSIL/XenoRAT.RDB!MTB
PandaTrj/Chgt.AD
SangforTrojan.Msil.Kryptik.V4va
SkyhighArtemis!Trojan
SophosMal/Generic-S
TencentTrojan.Msil.Agent.16001264
TrellixENSArtemis!BB4B3FD0C725
TrendMicro-HouseCallTrojan.Win32.VSX.PE04C9z
VBA32TScope.Trojan.MSIL
VIPREGen:Variant.Jalapeno.18019
VaristW32/MSIL_Kryptik.LEF.gen!Eldorado
XcitiumMalware@#xvgsth7ohly0
YandexTrojan.Igent.b2zurR.1
ZillyaTrojan.Kryptik.Win32.4828184
alibabacloudTrojan:MSIL/XenoRat.RXF2XJC
huorongTrojanSpy/MSIL.Stealer.ada!crit

Network contacts

91.92.248.167

Process list

NameCommand line
odemetarihleri.scr.exe
odemetarihleri.scr.exe
odemetarihleri.scr.exe
odemetarihleri.scr.exe
odemetarihleri.scr.exe
WerFault.exe-u -p 7760 -s 72
odemetarihleri.scr.exe
odemetarihleri.scr.exe
schtasks.exe/Create /TN "dms" /XML "%TEMP%\tmpA685.tmp" /F
odemetarihleri.scr.exe
WerFault.exe-pss -s 464 -p 7760 -ip 7760
odemetarihleri.scr.exe
odemetarihleri.scr.exe
odemetarihleri.scr.exe
odemetarihleri.scr.exe
odemetarihleri.scr.exe
odemetarihleri.scr.exe
odemetarihleri.scr.exe
schtasks.exe/Create /TN "dms" /XML "%TEMP%\tmp734C.tmp" /F
odemetarihleri.scr.exe