MALICIOUS — virussign.com_5ba1835522b0e4547386f84c32ab5e00.vir

MALICIOUS — virussign.com_5ba1835522b0e4547386f84c32ab5e00.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (85/100), attributed to the Ravartar family. 3 of 52 detection engines flagged it.

Identification

• SHA-256: 1e9a90e22d44bb0f2721cef15f225c38edb7cc0247d5dee57f622e67c8c27b1e
• SHA-1: c196b342842ea0e7db2c2652bcffbab56f427020
• MD5: 5ba1835522b0e4547386f84c32ab5e00
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 1536:p71pLgxwblHA0o62EoKX5BzO0JTUe6t27oB2/1UDi1k3tTlOO1:pU6lDo69Ba2qt27ow4i1etTl3
• TLSH: T1F34CFD42B8EF4216C616D9DC1878AC5FB98D77BEB43F111263265E7114D8E2F2840FA2
• Submitted as: virussign.com_5ba1835522b0e4547386f84c32ab5e00.vir
• File type: pe · Size: 539648 bytes
• Verdict: malicious (85/100) · Family: Ravartar

Detections (3 of 52 engines)

• Microsoft Defender: Trojan:Win32/Ravartar!rfn
• Emsisoft (Emergency Kit): Trojan.Generic.40298874
• Kaspersky (KVRT): Worm.Win32.AutoRun.bhir

Why this verdict

The malicious score of 85/100 is the fusion of 3 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Ravartar!rfn (rule Trojan:Win32/Ravartar!rfn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.40298874 (rule Trojan.Generic.40298874) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Worm.Win32.AutoRun.bhir (rule Worm.Win32.AutoRun.bhir) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

More Ravartar samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report