27e2394f7b506257a8afa48049a8fe2fef59dc87957def06bd51d1d9dc191732_payload.exe

Classification: Malicious

27e2394f7b506257a8afa48049a8fe2fef59dc87957def06bd51d1d9dc191732_payload.exe is a trojan (application/x-dosexec). Detected by 80 antivirus engines.

Detection summary

  • 80 antivirus detections
  • 0 IDS alerts
  • 0 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: ROKRAT (S0240)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2026-09-13 07:45:06 2026-09-13 07:45:06 malicious-activity
RokRAT ThreatFox Abuse.ch 2024-07-12 15:01:06 2024-07-14 14:45:09 S0240 ROKRAT
Generic.Malware MalwareBazaar Abuse.ch 2024-07-12 11:19:57 2024-07-12 11:19:57 malicious-activity

Tags

win.rokrat dogcall evasive ransomware

Sample information

Filenames
d5028e10a756f2df677f32ebde105d7de8df37e253c431837c8f810260f4428e, 27e2394f7b506257a8afa48049a8fe2fef59dc87957def06bd51d1d9dc191732_payload.exe
File type
application/x-dosexec
MD5
a186adfbd28c7e573d1fe5b4f7f54cf7
SHA-1
42e384baa0b01cb680eb7a73406e47a0ea50e446
SHA-256
d5028e10a756f2df677f32ebde105d7de8df37e253c431837c8f810260f4428e
First indexed
2024-07-12 12:21:12
Last updated
2026-09-13 07:45:07

Antivirus detections

EngineDetection
APEXMalicious
AVGWin32:TrojanX-gen [Trj]
AhnLab-V3Trojan/Win.XenoRAT.C5586957
AlibabaBackdoor:MSIL/Dothetuk.6ece9960
ArcabitTrojan.MSIL.Krypt.!cdmip!.2
AvastWin32:TrojanX-gen [Trj]
AviraHEUR/AGEN.1371394
BitDefenderGen:Heur.MSIL.Krypt.!cdmip!.2
BitDefenderThetaGen:NN.ZemsilF.36804.cm0@aSWHJTh
BkavW32.AIDetectMalware.CS
CAT-QuickHealTrojan.YakbeexMSIL.ZZ4
ClamAVWin.Malware.Msilzilla-10023780-0
Cylanceunsafe
DeepInstinctMALICIOUS
DrWebBackDoor.XenoRatNET.11
ESET-NOD32a variant of MSIL/Agent.WNX
Elasticmalicious (high confidence)
EmsisoftGen:Heur.MSIL.Krypt.!cdmip!.2 (B)
F-SecureHeuristic.HEUR/AGEN.1371394
FireEyeGeneric.mg.a186adfbd28c7e57
FortinetMSIL/Agent.WNX!tr
GDataMSIL.Trojan.PSE.13DA3Q2
GoogleDetected
GridinsoftTrojan.Win32.Agent.dd!ni
IkarusTrojan.MSIL.XenoRat
JiangminBackdoor.MSIL.gilv
K7AntiVirusTrojan ( 005acc631 )
K7GWTrojan ( 005acc631 )
KasperskyHEUR:Backdoor.MSIL.Agent.gen
KingsoftMSIL.Backdoor.Agent.gen
LionicTrojan.Win32.Agent.Y!c
MAXmalware (ai score=87)
MalwarebytesTrojan.MalPack.Generic
MaxSecureTrojan.Malware.121218.susgen
McAfeeXenoRat!A186ADFBD28C
MicroWorld-eScanGen:Heur.MSIL.Krypt.!cdmip!.2
MicrosoftTrojan:MSIL/Dothetuk.AM!MTB
Paloaltogeneric.ml
PandaTrj/CI.A
RisingBackdoor.XenoRAT!1.F6EA (CLASSIC)
SangforBackdoor.Msil.Agent.Vpan
SentinelOneStatic AI - Malicious PE
SkyhighBigisoft!A186ADFBD28C
SophosMal/RAT-C
SymantecML.Attribute.HighConfidence
TACHYONTrojan/W32.DN-VBKrypt.46592
TencentBackdoor.MSIL.Agent.kc
TrendMicroTROJ_GEN.R002C0DE624
TrendMicro-HouseCallTROJ_GEN.R002C0DE624
VIPREGen:Heur.MSIL.Krypt.!cdmip!.2
VaristW32/MSIL_Agent.IBH.gen!Eldorado
VirITTrojan.Win32.Genus.VHY
WebrootW32.Malware.Gen
ZoneAlarmHEUR:Backdoor.MSIL.Agent.gen
alibabacloudRat:Win/Xenorat
AVGWin32:MalwareX-gen [Bd]
AvastWin32:MalwareX-gen [Bd]
AviraHEUR/AGEN.1378547
CTXexe.trojan.msil
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DrWebBackDoor.XenoRat.20
ElasticWindows.Trojan.Xeno
F-SecureHeuristic.HEUR/AGEN.1378547
GDataMSIL.Trojan.PSE.19V0EDM
IkarusBackdoor.XenoRat
K7AntiVirusTrojan ( 005b11ae1 )
K7GWTrojan ( 005b11ae1 )
LionicTrojan.Win32.XenoRat.m!c
MaxSecureTrojan.Malware.11035479.susgen
McAfeeDReal Protect-LS!A186ADFBD28C
MicrosoftTrojan:MSIL/XenoRat.SG!MTB
SangforTrojan.Win32.Save.a
SkyhighXenoRAT!A186ADFBD28C
TrellixENSXenoRat!A186ADFBD28C
TrendMicro-HouseCallBackdoor.MSIL.XENORAT.SMTPTMA
VBA32TScope.Trojan.MSIL
ZillyaTrojan.Agent.Win32.3938202
ZoneAlarmMal/RAT-C
huorongTrojan/MSIL.Agent.dj

Network contacts

77.221.152.198