SUSPICIOUS — virussign.com_992f3fa3abd6c38fd71dd8dcbab97fe0.vir

SUSPICIOUS — virussign.com_992f3fa3abd6c38fd71dd8dcbab97fe0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 3 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 02df8c5b2b9195dd7424541d072601d87eef87074d1626ec02f8f1abbaeb9a58
SHA-1: 492896b8590cf304df9a57f8a9018ea0ff810b11
MD5: 992f3fa3abd6c38fd71dd8dcbab97fe0
imphash: 6ed4f5f04d62b18d96b26d6db7c18840
ssdeep: 3072:Js8pEwxWG6+52/A1JVvh/ZJ6ptmaAMfsitUUC6QNMfh6hpTSY2k:JsY7R6YcWJVvxZJ6ptbsitU3MZ+Sbk
TLSH: T1B945F13364B99207D5E0ED9FB472DC5C612D1F1696B1117B1A2A2D238FA782B08930DB
Submitted as: virussign.com_992f3fa3abd6c38fd71dd8dcbab97fe0.vir
File type: pe · Size: 282112 bytes
Verdict: suspicious (54/100)

Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified

Detections (3 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
Microsoft Defender: Trojan:Win32/Copak.KKA!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Copak.pef

MITRE ATT&CK

Why this verdict

The suspicious score of 54/100 is the fusion of 6 weighted signals:

Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (39 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

8919 behavior events · 2 ATT&CK techniques · 28 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D588C464E3D4F9F1F5D043A1B7C9A7E - 6d8a0c6dc46e740e9c28160080dc069f5eb7fb071e66dd89de62430e64423a9c
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B625C9EE8BD3E6849AFA2339291AE3C - e7ca2861d4473372540c4d777e1653b97688e62d8c4a168cc6d312763405416d
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BDE28772A83DB7274166C9CC07B6A827 - ceaa2a9d74d24d034d40b23d7f7260a3f2ecea2f99fe55c818b391da577981cd
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - c01a88e38af534cdf59f715527651926cc8c1b073008cbbf64d2a66f77f9341c
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D - 96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9840D2EA9A291B957CCF8D40A94DDAA4 - 459e139291ccb27700267f8a4242aa4ed6a6343b86388bb59897d5916cb8ce93
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 - 034e79e8c9633a6ff286bd876a0b1338bd55323c5cf8b40af34db55d02f061d1
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BDE28772A83DB7274166C9CC07B6A827 - 0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B625C9EE8BD3E6849AFA2339291AE3C - 241b14303d5dea916628aea3c73efa51639783e8e24330870891a46bbbdcc2a2
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 - f72e40de268ff0ba208c3b320afd72a570f5983342faffdc60838d0ca35d6f71
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9840D2EA9A291B957CCF8D40A94DDAA4 - 62c7d8743f57512fce50407091a7e38e3bd4458755fac65bb7167c649ce430b0
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D588C464E3D4F9F1F5D043A1B7C9A7E - fd8c6b844aec11917cc541664ef8021cb1b0c1fa34158d037971b325983f3702

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787727380&P2=404&P3=2&P4=IsBCl4%2f9swo1K%2b%2f5RSjb9oTBoe85SeNUqb5FYQ5LH8O6gN%2fQ%2bgIwtaW74tJMF1PrKbSHz4blKRVl9Lw%2bfky7OA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://ye.i.lencr.org/
http://x2.i.lencr.org/
http://x1.i.lencr.org/
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye1.c.lencr.org/103.crl
http://q.gs/EVnYC
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/pyeoXlQPF4E.crl
http://c.pki.goog/we1/USODfqcOxVM.crl

Embedded domains

cutit.org
ye.i.lencr.org
x2.i.lencr.org
x1.i.lencr.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye1.c.lencr.org
q.gs
publisher.linkvertise.com
linkvertise.com

Embedded IP addresses

52.110.12.42
52.110.12.37
20.184.175.10
4.247.188.233
4.144.132.114
135.232.92.137
4.230.171.124
4.207.44.67
74.178.240.51
85.210.193.152
52.123.129.14
20.112.250.133
52.123.128.14
203.26.79.13
135.233.45.223
52.123.252.226
52.148.114.188
52.123.252.225
74.178.232.29
52.123.252.194
20.42.179.204
72.153.5.131
104.18.0.75
142.251.222.227
104.21.84.133

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report