MALICIOUS — 1bfff6fda12148582641583026420a700c35d90f117f1d6e274d7dfe3d0b2ac3

MALICIOUS — 1bfff6fda12148582641583026420a700c35d90f117f1d6e274d7dfe3d0b2ac3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the STRATO family. 5 of 52 detection engines flagged it.

Identification

SHA-256: 1bfff6fda12148582641583026420a700c35d90f117f1d6e274d7dfe3d0b2ac3
SHA-1: 33ca725e08ae47d30bf9981b240ef34e26aa0a88
MD5: 05d2c48b220700799fccddf0a596f886
imphash: fe7079d1e5599342ee2ef4d058c64043
ssdeep: 196608:gwoe8g9VzrhJlALSN46yuRIFwacGKjv/AE4aHUsBG3:gwoeDXzlD94iJacGKTmaH7BG3
TLSH: T1A86833C53F323324FF88278E6C91D64CA4A9EB4537ACB5760AAA681C4DBD16F53D2104
Submitted as: 1bfff6fda12148582641583026420a700c35d90f117f1d6e274d7dfe3d0b2ac3
File type: pe · Size: 7919109 bytes
Verdict: malicious (91/100) · Family: STRATO

Detections (5 of 52 engines)

ClamAV (daily): Win.Trojan.Agent-1139220
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
Microsoft Defender: Backdoor:Win32/Shiz.DF!MTB
Emsisoft (Emergency Kit): Trojan.GenericKD.38816690
Kaspersky (KVRT): Trojan.Win32.Biws.b

Why this verdict

The malicious score of 91/100 is the fusion of 3 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-1139220 (rule Win.Trojan.Agent-1139220) - engine signal, weight 0.90, confidence 0.95
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.baidu.com - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

http://www.baidu.com

Embedded domains

www.baidu.com
7.pw
hi.fi
uv.sg
d.su

File paths

C:\Temp
X:\:`:d:h:l:p:t:x:
X:\h\
k:\f4R

More STRATO samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report