SUSPICIOUS — virussign.com_04845e070c8bfdac1e1a6c3b9458a270.vir
SUSPICIOUS — virussign.com_04845e070c8bfdac1e1a6c3b9458a270.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (63/100), attributed to the STRATO family. 2 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
db5fb312e35a70db5437d1ff5a80e10c2629cc5774e514fb3d252ab25d7678a8 - SHA-1:
bd8c4bd620b08a878b92b5968d637811bf815b85 - MD5:
04845e070c8bfdac1e1a6c3b9458a270 - imphash:
d59eccba9cd0b3e68e755c9706c269d7 - ssdeep:
24576:WVX8dzMTmdoP8gBJXliwvXm2PPe7vJKhRMfyZHSsWZ7teA:WVX0MHVHcwv2WerBfyJg - TLSH:
T163569EE5C2356313F9FADA1C1D351ACD5C22F2F94AA1D80C8B83DD6AA0E1E275470678 - Submitted as: virussign.com_04845e070c8bfdac1e1a6c3b9458a270.vir
- File type: pe · Size: 1428992 bytes
- Verdict: suspicious (63/100) · Family: STRATO
Source: VirusSign · first seen 2026-08-12T00:00:00.000Z · SHA-256 verified
Detections (2 of 52 engines)
- capa (capabilities): capability:collection/keylog
- YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
MITRE ATT&CK
Why this verdict
The suspicious score of 63/100 is the fusion of 4 weighted signals:
- capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule
STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://yanderetogether.com, https://discord.gg/HVTxZujhtd, https://yanderetogether.com/manifest.txt - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://schemas.microsoft.com/SMI/2016/WindowsSettings
- https://yanderetogether.com
- https://discord.gg/HVTxZujhtd
- https://yanderetogether.com/manifest.txt
Embedded domains
- schemas.microsoft.com
- 1.be
- yanderetogether.com
- discord.gg
More STRATO samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report