MALICIOUS — 6d8d3f1ed3dbcfc7470bfdb7814b049f2dcd5248773c9ebf2c554892bb3011c4.exe
MALICIOUS — 6d8d3f1ed3dbcfc7470bfdb7814b049f2dcd5248773c9ebf2c554892bb3011c4.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Egairtigado family. 7 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
6d8d3f1ed3dbcfc7470bfdb7814b049f2dcd5248773c9ebf2c554892bb3011c4 - SHA-1:
4793486c9fee140382dee47c02dc2ca2816da340 - MD5:
4bf11589985675d20577e3a8e1b84819 - imphash:
d8b31f8c03e0c76ff245ed05a15ffe6c - ssdeep:
49152:+Ncgla7UfpBVPCz27nqFPg+j/j7oBssjdVuDIk9vpV6JI38kcnxNdTcd2Y8PRqFU:+NprpFLMmbtRdaW9Dt1yXi - TLSH:
T16B62BEA8095B2160D9F9CD56AC22C0DCC8837A06D27266C90393DE7645D9FFFDBB041A - Submitted as: 6d8d3f1ed3dbcfc7470bfdb7814b049f2dcd5248773c9ebf2c554892bb3011c4.exe
- File type: pe · Size: 4283032 bytes
- Verdict: malicious (98/100) · Family: Egairtigado
Source: MalwareBazaar · first seen 2026-07-27T00:00:00.000Z · SHA-256 verified
Detections (7 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): Go
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Hash: abuse.ch ThreatFox: known-malicious-hash
- Detect It Easy (packer/type): DIE:Go
- Microsoft Defender: Trojan:Win32/Egairtigado!rfn
- Emsisoft (Emergency Kit): Trojan.GenericKD.80951740
- Kaspersky (KVRT): HEUR:Backdoor.Win64.Gsb.pef
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 8 weighted signals:
- Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule
known-malicious-hash) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Egairtigado!rfn (rule
Trojan:Win32/Egairtigado!rfn) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80951740 (rule
Trojan.GenericKD.80951740) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Go (rule
DIE:Go) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: Go - static signal, weight 0.25, confidence 0.55
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
301 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- staging.to-do.officeppe.com
- www.bing.com
- config.edge.skype.com
- desktop-hsgcbep
- dns.msftncsi.com
- ctldl.windowsupdate.com
- to-do.microsoft.com
- settings-win.data.microsoft.com
- staging.to-do.microsoft.com
- watson.events.data.microsoft.com
- edge.microsoft.com
- aps.prod.windows.com
- msedge.api.cdp.microsoft.com
- 192.168.122.108
- 192.168.122.1
- 192.168.122.255
- 224.0.0.252
- 192.168.122.107
Embedded domains
- abi.name
- godebugs.info
- runtime.link
- eq.io
- runtime.work
- staging.to-do.officeppe.com
File paths
- C:\crossdev\gccmaster\build-tdm64\runtime\mingw-w64-crt
- C:\crossdev\gccmaster\build-tdm64\gcc-seh\x86_64-w64-mingw32\libgcc
- C:\Users\Administrator\Desktop\FBox\temp\gyOUmWEAdW\go\src\runtime\cgo
More Egairtigado samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report