SUSPICIOUS — README.txt

SUSPICIOUS — README.txt is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (49/100), attributed to the STRATO family. 1 of 53 detection engines flagged it.

Identification

• SHA-256: c026d38c0b59af5cf01860ec1d3362ec69f2e57b7e02ebc915cc0e4bddd0214f
• SHA-1: 69f2ee09027462555a403020ad52b46423493e94
• MD5: ae3d95c3f80580379ae9ac22d3fac6f7
• ssdeep: 48:xqG/xgdBoZVobuKfZ1AapJAnnR127Mq1kDLs:1xgIPobusTA6SWMcP
• TLSH: T17B1481956B12033E13266C6F48CD8A08E260D95F30F356309791C3E87E3E870900E4E3
• Submitted as: README.txt
• File type: unknown · Size: 1931 bytes
• Verdict: suspicious (49/100) · Family: STRATO

Detections (1 of 53 engines)

• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2

Why this verdict

The suspicious score of 49/100 is the fusion of 2 weighted signals:

• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
• Embedded network infrastructure: https://qtox.github.io/, http://lthicpjqc7gkn5eq3epxndc2uig3yngvcbdya4u3m3byjod5km4yuwqd.onion/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://qtox.github.io/
• http://lthicpjqc7gkn5eq3epxndc2uig3yngvcbdya4u3m3byjod5km4yuwqd.onion/

Embedded domains

• protonmail.com
• qtox.github.io
• lthicpjqc7gkn5eq3epxndc2uig3yngvcbdya4u3m3byjod5km4yuwqd.onion

More STRATO samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report