RFQ-DIAROUGH 794704.exe

Classification: Malicious

RFQ-DIAROUGH 794704.exe is a trojan (Windows executable, 984.5 KB). Flagged by 78% of antivirus engines (80 detections). Linked to Apt37 activity.

Detection summary

  • 80 antivirus detections (78% detection ratio)
  • 1 IDS alerts
  • 10 processes observed
  • 1 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: APT37 (G0067)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2023-09-10 18:00:02 2023-09-10 18:00:02
Apt37 Maltiverse 2023-07-04 04:28:50 2023-07-05 20:51:12 malicious-activity G0067 APT37
Backdoor VM-Ray 2023-06-08 13:22:13 2023-06-08 13:22:13

Tags

exploit infostealer qakbot apt

Sample information

Filenames
f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9.exe, RFQ-DIAROUGH 794704.exe
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
1008128 bytes
MD5
c54fea66c5150e6d924ca83f504c1aa4
SHA-1
14bb12af44b33a9177bd38f22f970f7e3db80bc9
SHA-256
f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9
First indexed
2023-06-08 11:56:31
Last updated
2025-04-21 11:41:10

Antivirus detections

EngineDetection
BkavW32.AIDetectMalware
Elasticmalicious (high confidence)
DrWebTrojan.PackedNET.2050
MicroWorld-eScanTrojan.GenericKD.67237337
McAfeeGenericRXWA-ZN!C54FEA66C515
MalwarebytesGeneric.Crypt.Trojan.DDS
AlibabaTrojanSpy:MSIL/SnakeLogger.6a3b4559
BitDefenderThetaGen:NN.ZemsilF.36250.9m0@aqfKgOg
VirITTrojan.Win32.PSWStealer.DRI
CyrenW32/MSIL_Troj.CPK.gen!Eldorado
SymantecScr.Malcode!gdn34
ESET-NOD32a variant of MSIL/Kryptik.AIWZ
APEXMalicious
CynetMalicious (score: 100)
KasperskyHEUR:Trojan-Spy.MSIL.SnakeLogger.gen
BitDefenderTrojan.GenericKD.67237337
AvastWin32:PWSX-gen [Trj]
TencentMsil.Trojan-Spy.Snakelogger.Icnw
EmsisoftTrojan.GenericKD.67237337 (B)
VIPRETrojan.GenericKD.67237337
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
FireEyeTrojan.GenericKD.67237337
SophosMal/Generic-S
SentinelOneStatic AI - Suspicious PE
GDataTrojan.GenericKD.67237337
MAXmalware (ai score=85)
Antiy-AVLTrojan/MSIL.Kryptik
ArcabitTrojan.Generic.D401F5D9
ZoneAlarmHEUR:Trojan-Spy.MSIL.SnakeLogger.gen
MicrosoftTrojan:MSIL/Taskun.ABXQ!MTB
GoogleDetected
AhnLab-V3Trojan/Win.PWSX-gen.C5433365
ALYacTrojan.GenericKD.67237337
PandaTrj/GdSda.A
RisingMalware.Obfus/[email protected] (RDM.MSIL2:I2pnu7dFp5rmOLAvhWvhEg)
IkarusTrojan.MSIL.Krypt
MaxSecureTrojan.Malware.300983.susgen
FortinetMSIL/GenericKD.66824822!tr
AVGWin32:PWSX-gen [Trj]
DeepInstinctMALICIOUS
CrowdStrikewin/malicious_confidence_100% (W)
ALYacGen:Variant.Ransom.Loki.2180
AVGWin32:MalwareX-gen [Pws]
AlibabaTrojanSpy:MSIL/Taskun.437c6261
ArcabitTrojan.Ransom.Loki.D884
AvastWin32:MalwareX-gen [Pws]
AviraHEUR/AGEN.1365006
BitDefenderGen:Variant.Ransom.Loki.2180
BkavW32.AIDetectMalware.CS
CAT-QuickHealTrojan.GenericFC.S30550382
CTXexe.trojan.msil
ClamAVWin.Packed.LokiBot-10022948-0
CylanceUnsafe
EmsisoftGen:Variant.Ransom.Loki.2180 (B)
F-SecureHeuristic.HEUR/AGEN.1365006
GDataGen:Variant.Ransom.Loki.2180
K7AntiVirusTrojan ( 700000121 )
K7GWTrojan ( aaa0070a1 )
KingsoftWin32.Troj.Generic.v
LionicTrojan.Win32.SnakeLogger.l!c
MaxSecureTrojan.Malware.184879108.susgen
McAfeeGenericRXWB-WO!C54FEA66C515
McAfeeDti!F0B85C3D8900
MicroWorld-eScanGen:Variant.Ransom.Loki.2180
NANO-AntivirusTrojan.Win32.SnakeLogger.jwpspd
Paloaltogeneric.ml
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighBehavesLike.Win32.Generic.dc
SophosTroj/MSIL-TAR
TencentMalware.Win32.Gencirc.13cc6cac
TrendMicro-HouseCallTrojan.Win32.VSX.PE04C9V
VBA32TScope.Trojan.MSIL
VIPREGen:Variant.Ransom.Loki.2180
VaristW32/MSIL_Troj.CPK.gen!Eldorado
WebrootW32.Trojan.MSIL.AGensla
XcitiumMalware@#10a67a2148ijj
ZoneAlarmTroj/MSIL-TAR
alibabacloudTrojan[spy]:MSIL/Taskun.AKFY3DGW
huorongTrojanSpy/MSIL.AgentTesla.nh

Network contacts

212.193.30.230

Process list

NameCommand line
RFQ-DIAROUGH794704.exe
powershell.exeAdd-MpPreference -ExclusionPath "C:\RFQ-DIAROUGH794704.exe"
powershell.exeAdd-MpPreference -ExclusionPath "%APPDATA%\CFnqYf.exe"
schtasks.exe/Create /TN "Updates\CFnqYf" /XML "%TEMP%\tmpC5F.tmp"
RFQ-DIAROUGH794704.exe
remcos.exe
powershell.exeAdd-MpPreference -ExclusionPath "%ALLUSERSPROFILE%\Remcos\remcos.exe"
powershell.exeAdd-MpPreference -ExclusionPath "%APPDATA%\CFnqYf.exe"
schtasks.exe/Create /TN "Updates\CFnqYf" /XML "%TEMP%\tmp400C.tmp"
remcos.exe