MALICIOUS — 316a011169a7b30844d28b1e1afd0add0343f8310464ef9410569c8b12929068.exe

MALICIOUS — 316a011169a7b30844d28b1e1afd0add0343f8310464ef9410569c8b12929068.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100), attributed to the Egairtigado family. 6 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 316a011169a7b30844d28b1e1afd0add0343f8310464ef9410569c8b12929068
• SHA-1: 716c11e4eee29ecd7b964924b926d2f6ef9b779b
• MD5: 382cee212140df012150595bd32aa01f
• imphash: d42595b695fc008ef2c56aabd8efd68e
• ssdeep: 49152:T1ZvDJ1DrbCLhYtVps8TJUIEB/ZSVVOuEUNIIv1N2CMh/zsnYmBpD:TDzsDGVOUN9v17w/wn91
• TLSH: T18D619E68969B3160D9F9D948F876809CC8B77806D270EA8D8353D83A01E7FB7D5F005A
• Submitted as: 316a011169a7b30844d28b1e1afd0add0343f8310464ef9410569c8b12929068.exe
• File type: pe · Size: 3833688 bytes
• Verdict: malicious (88/100) · Family: Egairtigado

Source: MalwareBazaar · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified

Detections (6 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): Go
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:Go
• Microsoft Defender: Trojan:Win32/Egairtigado!rfn
• Emsisoft (Emergency Kit): Trojan.GenericKD.80975378
• Kaspersky (KVRT): Trojan.Win64.Agent.smgwic

MITRE ATT&CK

• T1057

Why this verdict

The malicious score of 88/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Egairtigado!rfn (rule Trojan:Win32/Egairtigado!rfn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80975378 (rule Trojan.GenericKD.80975378) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Go (rule DIE:Go) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: Go - static signal, weight 0.25, confidence 0.55
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• none

Dropped files

• b8e1b4d8d448497d9660f4f809683f3676bb8256c95cd05429a94070abcaa0bc - b8e1b4d8d448497d9660f4f809683f3676bb8256c95cd05429a94070abcaa0bc

Embedded domains

• abi.name
• godebugs.info
• json.name
• runtime.link
• reflectlite.rtype.name
• eq.io
• go.shape.int
• runtime.work

More Egairtigado samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report