MALICIOUS — virussign.com_6c6ca339fcb285950f9f47bc55421790.vir

MALICIOUS — virussign.com_6c6ca339fcb285950f9f47bc55421790.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Soltern family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 02defe11cee2f65eb62ea1c7e3998beefade0ad43e6bcbdc63fa2219a18672b7
• SHA-1: 31a8c035fa8c8cd7b63b0698937a2f62e13e840d
• MD5: 6c6ca339fcb285950f9f47bc55421790
• imphash: 793b10b65bae23d68761b52d8b4c797a
• ssdeep: 1536:7cbqyEk65QiMa2Zi2tSVG4FnjJdLLAv6XH9T5Faj2tauW22DQwhuq6+:ALSQilNIHujLLAv6XH9TSpud2Jhf6+
• TLSH: T148398C3C1A2A7703EB3AC6714642BB8D4423F8E51526509D5B5780FCB3EBCE3A99191C
• Submitted as: virussign.com_6c6ca339fcb285950f9f47bc55421790.vir
• File type: pe · Size: 91514 bytes
• Verdict: malicious (99/100) · Family: Soltern

Source: VirusSign · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (5 of 53 engines)

• ClamAV (daily): Win.Worm.Soltern-1
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): Trojan.GenericKD.80137443
• Kaspersky (KVRT): P2P-Worm.Win32.Sytro.l

MITRE ATT&CK

• T1547.001
• T1112

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

• ClamAV (daily) flagged Win.Worm.Soltern-1 (rule Win.Worm.Soltern-1) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8048) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80137443 (rule Trojan.GenericKD.80137443) - engine signal, weight 0.55, confidence 0.85
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

133 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• staging.to-do.officeppe.com
• s-0005.dual-s-msedge.net
• teams.cloud.microsoft
• outlook.office.com
• atm.outlook.mira.tm.svc.cloud.microsoft
• outlook.office365.com
• outlook.cloud.microsoft
• cl-glcb907925.gcdn.co
• settings-prod-scus-1-tagged.southcentralus.cloudapp.azure.com
• www.msftconnecttest.com
• settings-prod-eus2-1-tagged.eastus2.cloudapp.azure.com
• ln-0007.ln-msedge.net
• onedsblobvmssprdwus02.westus.cloudapp.azure.com
• onedsblobvmssprdwus03.westus.cloudapp.azure.com
• teams-mrc-ww-perf.tm-4.office.com
• searchapp.bundleassets.example
• svc.ms-acdc-teams.office.com
• mr-b02.tm-azurefd.net
• config.edge.skype.com
• tas02.sls.update.microsoft.com

Embedded domains

• battle.net
• glb.sls.prod.dcat.dsp.trafficmanager.net
• reroute443.trafficmanager.net
• staging.to-do.officeppe.com
• s-0005.dual-s-msedge.net
• teams.cloud.microsoft
• atm.outlook.mira.tm.svc.cloud.microsoft
• outlook.cloud.microsoft
• cl-glcb907925.gcdn.co
• ln-0007.ln-msedge.net
• glb.api.prod.dcat.dsp.trafficmanager.net
• mr-b02.tm-azurefd.net
• outlook.office.com
• outlook.office365.com
• settings-prod-scus-1-tagged.southcentralus.cloudapp.azure.com
• www.msftconnecttest.com
• settings-prod-eus2-1-tagged.eastus2.cloudapp.azure.com
• onedsblobvmssprdwus02.westus.cloudapp.azure.com
• onedsblobvmssprdwus03.westus.cloudapp.azure.com
• teams-mrc-ww-perf.tm-4.office.com
• searchapp.bundleassets.example
• svc.ms-acdc-teams.office.com
• config.edge.skype.com
• tas02.sls.update.microsoft.com
• to-do.microsoft.com

More Soltern samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report