MALICIOUS — PlayGTAV.exe

MALICIOUS — PlayGTAV.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100), attributed to the STRATO family. 4 of 55 detection engines flagged it.

Identification

• SHA-256: a5d731f67f55f0f7af9cf6ae078cf0ec65dccd66cc07f88092afff6419579612
• SHA-1: 9f8a5204379e1c34ba6b7305d8984e0d8fda685b
• MD5: 30ffeb77977d9cc28f35ba6d4456b998
• imphash: 04f6575dfb8e5e7bc27a4ac9592dbd4f
• ssdeep: 49152:1E6CcqQ5DUF3PDDaTgQlhbgUmIyfCVTqMMfjuRn5Gkuz:1E6C1Q5DUF3PO3qIT1J5Gk
• TLSH: T1E15D23A6A1743A96EBB3CE58792E344C4F62FCE5AC3479C1A1086427113507F5CE60AF
• Submitted as: PlayGTAV.exe
• File type: pe · Size: 2634240 bytes
• Verdict: malicious (83/100) · Family: STRATO

Detections (4 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:RNE2
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• Detect It Easy (packer/type): DIE:VMProtect
• Emsisoft (Emergency Kit): Trojan.GenericKD.77670364

Why this verdict

The malicious score of 83/100 is the fusion of 5 weighted signals:

• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.77670364 (rule Trojan.GenericKD.77670364) - engine signal, weight 0.55, confidence 0.85
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:VMProtect (rule DIE:VMProtect) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:RNE2 (rule high-entropy-sections:RNE2) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-sections:RNE2, VMProtect - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• i.gg

More STRATO samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report