MALICIOUS — virussign.com_6964303743f9680e79804a7db7abec80.vir

MALICIOUS — virussign.com_6964303743f9680e79804a7db7abec80.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Copak family. 3 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 05e2815688bb8aac0ca3091ac102d850d77a0ffa0fa8f4ea3a4fcc3d668a7ed0
• SHA-1: 2cfa1dac2a6e2ceec295ad832463a932ce2b4614
• MD5: 6964303743f9680e79804a7db7abec80
• imphash: 6ed4f5f04d62b18d96b26d6db7c18840
• ssdeep: 3072:xy7ZzKhaGZIYs6gir9pxWhsPD6E6i+c2zTKK1oPWz53:xy61/sEJQqvxfgWOoS3
• TLSH: T1CB52DDB108FE0E2FE6894B284153056E38E302D542445D909CF5FAB699F2CB73E6539B
• Submitted as: virussign.com_6964303743f9680e79804a7db7abec80.vir
• File type: pe · Size: 933242 bytes
• Verdict: malicious (94/100) · Family: Copak

Source: VirusSign · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified

Detections (3 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• Microsoft Defender: Trojan:Win32/Copak.KKA!MTB
• Kaspersky (KVRT): UDS:Trojan.Win32.Copak

MITRE ATT&CK

• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 94/100 is the fusion of 7 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Copak.KKA!MTB (rule Trojan:Win32/Copak.KKA!MTB) - engine signal, weight 0.55, confidence 0.85
• Dropped a suspicious payload (Copak): f64edc162d5f6e64e3f64d34d1e94d6aaabd6ca4280e645c8680039762b02c53 - dynamic signal, weight 0.50, confidence 0.90
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 56 external host(s) at runtime (52 HTTP) - network signal, weight 0.40, confidence 0.80
• Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

8904 behavior events · 2 ATT&CK techniques · 26 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• cutit.org
• ye.i.lencr.org
• x2.i.lencr.org
• x1.i.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• ye1.c.lencr.org
• q.gs
• publisher.linkvertise.com
• c.pki.goog

Dropped files

• /opt/CAPEv2/storage/analyses/29670/files/12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
• /opt/CAPEv2/storage/analyses/29670/files/63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0 - 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
• /opt/CAPEv2/storage/analyses/29670/files/2a39e046e562539a653bbf87f63ce5cea01a5f88ee5ba74ec86b12a6d9d33922 - 2a39e046e562539a653bbf87f63ce5cea01a5f88ee5ba74ec86b12a6d9d33922
• /opt/CAPEv2/storage/analyses/29670/files/881baa2510908ea3e4c44544d2850849a944304287c12af75b861258f89de8a1 - 881baa2510908ea3e4c44544d2850849a944304287c12af75b861258f89de8a1
• /opt/CAPEv2/storage/analyses/29670/files/96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6 - 96bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c6
• /opt/CAPEv2/storage/analyses/29670/files/f64edc162d5f6e64e3f64d34d1e94d6aaabd6ca4280e645c8680039762b02c53 - f64edc162d5f6e64e3f64d34d1e94d6aaabd6ca4280e645c8680039762b02c53
• /opt/CAPEv2/storage/analyses/29670/files/1d75dbca468c7a3eaedb9c82496ae9594dbaca0999c5cfbec84f54b79caffd64 - 1d75dbca468c7a3eaedb9c82496ae9594dbaca0999c5cfbec84f54b79caffd64
• /opt/CAPEv2/storage/analyses/29670/files/0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0 - 0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0
• /opt/CAPEv2/storage/analyses/29670/files/3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
• /opt/CAPEv2/storage/analyses/29670/files/d011e0fb0df5857939417d84a8451e4934a10f9f650a671023e10b95dea8c98c - d011e0fb0df5857939417d84a8451e4934a10f9f650a671023e10b95dea8c98c
• /opt/CAPEv2/storage/analyses/29670/files/f72e40de268ff0ba208c3b320afd72a570f5983342faffdc60838d0ca35d6f71 - f72e40de268ff0ba208c3b320afd72a570f5983342faffdc60838d0ca35d6f71
• /opt/CAPEv2/storage/analyses/29670/files/627e7e40b176f105b98885fd04e0e6c6f01584c8d93afdc08cd4ad6f33ba7781 - 627e7e40b176f105b98885fd04e0e6c6f01584c8d93afdc08cd4ad6f33ba7781
• /opt/CAPEv2/storage/analyses/29670/files/7db6d346971d9f0234ace04c34347a97c9b9cdb7e2c981454bf0a90fef73843b - 7db6d346971d9f0234ace04c34347a97c9b9cdb7e2c981454bf0a90fef73843b
• /opt/CAPEv2/storage/analyses/29670/files/d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c - d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
• /opt/CAPEv2/storage/analyses/29670/files/ee5f7abd6981bb0255632cd8f49283451b4b18844d12040b44ee00f07b8fe2c6 - ee5f7abd6981bb0255632cd8f49283451b4b18844d12040b44ee00f07b8fe2c6

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/2cbcf400-ac8d-4d86-9d69-c7f0dff56d2e?P1=1787062732&P2=404&P3=2&P4=kEupJ%2bELQLYdvQdSxk0CoAcMRRHdL5Y9RaKcZXx3R0VGFhU1GVQ8v71dqDkMrN52gFeumP7yv0R68e%2fSfhkEyw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
• http://ye.i.lencr.org/
• http://x2.i.lencr.org/
• http://x1.i.lencr.org/
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://ye1.c.lencr.org/103.crl
• http://q.gs/EVnYC
• http://c.pki.goog/r/gsr1.crl
• http://c.pki.goog/r/r4.crl
• http://c.pki.goog/we1/pyeoXlQPF4E.crl
• http://203.26.79.13/filestreamingservice//files/58b2a9b1-8570-476c-a7c2-f7ab0a20fbf9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/58b2a9b1-8570-476c-a7c2-f7ab0a20fbf9?P1=1787062809&P2=404&P3=2&P4=UBcrv7t8w3XcijOVGKNeWcW0spEBTonrU8yFjVRO6CFINBonSri%2bphydMvv1XJJgvoipTyLbGXaxxmPB7dQyoA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

• cutit.org
• ye.i.lencr.org
• x2.i.lencr.org
• x1.i.lencr.org
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• ye1.c.lencr.org
• q.gs
• publisher.linkvertise.com
• linkvertise.com

Embedded IP addresses

• 52.110.12.54
• 57.155.101.212
• 20.184.175.15
• 20.247.185.124
• 52.123.252.222
• 4.230.171.124
• 4.247.188.224
• 52.123.252.230
• 135.232.92.137
• 4.150.223.104
• 74.178.240.51
• 52.123.128.14
• 20.236.44.162
• 40.99.134.18
• 20.184.175.22
• 74.178.76.44
• 203.26.79.13
• 135.233.45.222
• 92.223.78.30
• 52.148.114.188
• 72.153.5.135
• 172.234.27.37
• 172.67.193.84
• 104.18.1.75
• 142.250.195.131

More Copak samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report