MALICIOUS — update.exe

MALICIOUS — update.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Egairtigado family. 4 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: c3b71a279800e79535b096b110c9cf27ff16b92cf0a18200dd777a9abae9a5e7
• SHA-1: 2485276a4bed442d34f2b10ea0181c5152f95616
• MD5: b61d829b6b1fc2ecc12a86db5d99d826
• imphash: 6ed4f5f04d62b18d96b26d6db7c18840
• ssdeep: 49152:Lm1UlgE++JhVsnnZHTPrjDMiyR6RtW8fUBCWygMGjn:q1UFVsntjDHyR6RtLUwWzR7
• TLSH: T1815933A287647117DDFDEE5472EAD04EB16678DAC0E9A0091C2DA20170E36FF16D7AC0
• Submitted as: update.exe
• File type: pe · Size: 1927680 bytes
• Verdict: malicious (84/100) · Family: Egairtigado

Detections (4 of 51 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• Detect It Easy (packer/type): DIE:UPX
• Microsoft Defender: Trojan:Win32/Egairtigado!rfn
• Emsisoft (Emergency Kit): Trojan.Ransom.Agent.FH

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 84/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Egairtigado!rfn (rule Trojan:Win32/Egairtigado!rfn) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Ransom.Agent.FH (rule Trojan.Ransom.Agent.FH) - engine signal, weight 0.55, confidence 0.85
• Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2164 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• none

More Egairtigado samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report