MALICIOUS — 00d91b827e3710cdb5c092a3626295d6d62f474893057614eae01c0f9ff8f374

MALICIOUS — 00d91b827e3710cdb5c092a3626295d6d62f474893057614eae01c0f9ff8f374 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Nitol family. 6 of 52 detection engines flagged it.

Identification

• SHA-256: 00d91b827e3710cdb5c092a3626295d6d62f474893057614eae01c0f9ff8f374
• SHA-1: 761b5060337a8ddc141d4f7c41ce7aa2911dbf79
• MD5: bb4187465fed81480206cd3f6fb95355
• imphash: 5ab1b7cc12d7164d03f8d8dc088b51ed
• ssdeep: 768:MDcpEBMLfQcub5Ep1PnGz96XyX9TdtldE9KfffO:MDcfLfIb5Ep1uzgyXVdtnJfffO
• TLSH: T16135074D4E57EB9AE1F996717C088D0C8EE9343EA26D1DC9DB83412D1BE30A79439068
• Submitted as: 00d91b827e3710cdb5c092a3626295d6d62f474893057614eae01c0f9ff8f374
• File type: pe · Size: 59344 bytes
• Verdict: malicious (92/100) · Family: Nitol

Detections (6 of 52 engines)

• ClamAV (daily): Win.Trojan.Nitol-6335025-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): Trojan.GenericKD.43547211
• Kaspersky (KVRT): HEUR:Trojan-DDoS.Win32.Nitol.gen

Why this verdict

The malicious score of 92/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Nitol-6335025-0 (rule Win.Trojan.Nitol-6335025-0) - engine signal, weight 0.90, confidence 0.95
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• www.baidu.com

More Nitol samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report