SUSPICIOUS — 银狐策略.txt
SUSPICIOUS — 银狐策略.txt is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (43/100), attributed to the Persistence family. 1 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
87815898e8dd9af8ca7da98b3058189acc13df3cdf15c0874dacdc8adabc5f75 - SHA-1:
45a479747b4a012e74dcb22b4711daff5dcc12af - MD5:
fc3a9a41371d58de12b25d4cebb8534e - ssdeep:
48:Rld+9NsAT7JOiW94Ws0yxc96b0RrHZifNbHldnc/sA4ZILUBjabzW:RDSXnWaWs0yyAwRrHgfNzDnSsA4ZmUBR - TLSH:
T166155139616A089B418565C97FC4418AF02FCD72677D288947C00FDF3A15A5EF4BE8AC - Submitted as: 银狐策略.txt
- File type: unknown · Size: 2575 bytes
- Verdict: suspicious (43/100) · Family: Persistence
Detections (1 of 53 engines)
- YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
MITRE ATT&CK
Why this verdict
The suspicious score of 43/100 is the fusion of 2 weighted signals:
- YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule
TL_Windows_Persistence_RunKey) - engine signal, weight 0.40, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Registry keys
- HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity
- HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard
- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
File paths
- C:\Windows\System32\CodeIntegrity\sipolicy.p7b
More Persistence samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report