SUSPICIOUS — prefetch.zip

SUSPICIOUS — prefetch.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (58/100), attributed to the STRATO family. 2 of 53 detection engines flagged it.

Identification

• SHA-256: 38f5018da2770d6f4ebe0931f871f00976eb9473c3ecb22b2436f9efa7852059
• SHA-1: d6591ae9dfc2a365eb197f1e3f751227055979ba
• MD5: 4a8be687509796aea1f37783ec1284d4
• ssdeep: 98304:5Czz8pN6o4cM0K384oiT9KLv8CaYzeRMPoq4ulQE8G0o+uwDWyCLI7CdWhVJv/E6:516f0Kqm9u0NKPodE8syCLI7vhVJvcxY
• TLSH: T18965339702ECD30AC305F56102CBF03D71DD265D34AA857A5AA7ABF20461A4B831DBB7
• Submitted as: prefetch.zip
• File type: zip · Size: 5864464 bytes
• Verdict: suspicious (58/100) · Family: STRATO

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2

Why this verdict

The suspicious score of 58/100 is the fusion of 3 weighted signals:

• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Embedded domains

• tt.kr
• 5c.au

File paths

• Y:\QW
• p:\M
• N:\45
• S:\j^Y

More STRATO samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report