MALICIOUS — 1916cfab459307852b4d845e05b4961ffddf742988d22d63531beffc7ec30e7c.exe

MALICIOUS — 1916cfab459307852b4d845e05b4961ffddf742988d22d63531beffc7ec30e7c.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (76/100), attributed to the Egairtigado family. 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 1916cfab459307852b4d845e05b4961ffddf742988d22d63531beffc7ec30e7c
• SHA-1: 79d18e501ece7dfdd617805a2ae88a41ff298f14
• MD5: 4201f4bee6795308915fc526773e1201
• imphash: 20dd26497880c05caed9305b3c8b9109
• ssdeep: 196608:d7q9w+Knw6b34+mXTnmte18xiyPHgjzgmcK7gkmP2sZ9ZObwWa6zXUuqLxj:89whnwo34bTnCeoHEzA6g52sgblzXUu0
• TLSH: T1C96C335B2F3F3462F991C498FA32456C4E7ABBF8C271BD055087B82E26674630C154AE
• Submitted as: 1916cfab459307852b4d845e05b4961ffddf742988d22d63531beffc7ec30e7c.exe
• File type: pe · Size: 11352255 bytes
• Verdict: malicious (76/100) · Family: Egairtigado

Source: MalwareBazaar · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): Turbo Linker
• Detect It Easy (packer/type): DIE:Turbo Linker
• Microsoft Defender: Trojan:Win32/Egairtigado!rfn
• Kaspersky (KVRT): Trojan.Win32.Penguish.hvq

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 76/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Egairtigado!rfn (rule Trojan:Win32/Egairtigado!rfn) - engine signal, weight 0.55, confidence 0.85
• Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: Turbo Linker - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2761 behavior events · 1 ATT&CK techniques · 3 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/5659/files/4b59bff3897ab941d01c918dbbd0f46fe538dc7ede7773e2f90507646d3c9e2f - 4b59bff3897ab941d01c918dbbd0f46fe538dc7ede7773e2f90507646d3c9e2f
• /opt/CAPEv2/storage/analyses/5659/files/3c73732dbf5dd0a75d1c909436983bfc4f20d8fa5bd9cd9a7a31e105dd2b71d9 - 3c73732dbf5dd0a75d1c909436983bfc4f20d8fa5bd9cd9a7a31e105dd2b71d9
• /opt/CAPEv2/storage/analyses/5659/files/dd441e75f948a792a49ca39debeaac43cac062ceca842136f36c6f57f4eca349 - dd441e75f948a792a49ca39debeaac43cac062ceca842136f36c6f57f4eca349

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline

Embedded domains

• schemas.microsoft.com
• b66.co
• yq.jp
• 7.co
• so.se
• 5.hk
• x.ua
• www.jrsoftware.org

File paths

• T:\m_
• Q:\Z~
• n:\-]
• b:\5B]
• b:\#$
• i:\:$h
• x:\dirname

More Egairtigado samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report