MALICIOUS — virussign.com_e8021f705f980c021ebe1989f0ad2160.vir

MALICIOUS — virussign.com_e8021f705f980c021ebe1989f0ad2160.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100), attributed to the Renos family. 5 of 52 detection engines flagged it.

Identification

• SHA-256: 0f57f27b3f994e9fd3f3e90c15f7dd527572d1372f72e33c5637789cac58855f
• SHA-1: 19e61dae3ce65124da991c26a99d5b24872c2b8b
• MD5: e8021f705f980c021ebe1989f0ad2160
• imphash: d10a853a7bfb3a1279ad7c63647d3096
• ssdeep: 3072:NRatKjR8G583CWfYJHrigXDCB7uBBL2mDgvLxD2oucquGcRbdfypKVlCYOjueXVS:rv7ndHrPTe7YWUoZGU5WUCNWP
• TLSH: T17443AE54A3417A74CD81C5D72CBADE7DF3612C8A24306E718194AF40787B3DBB8391AA
• Submitted as: virussign.com_e8021f705f980c021ebe1989f0ad2160.vir
• File type: pe · Size: 228864 bytes
• Verdict: malicious (86/100) · Family: Renos

Source: VirusSign · first seen 2026-08-10T00:00:00.000Z · SHA-256 verified

Detections (5 of 52 engines)

• ClamAV (daily): Win.Malware.Renos-10003934-0
• Microsoft Defender: Trojan:Win32/Glupteba.MT!MTB
• Emsisoft (Emergency Kit): Generic.Dacic.6001.6203EE7B
• Trellix Stinger (McAfee): Trojan-FVOQ!E8021F705F98
• Kaspersky (KVRT): UDS:Trojan.Win32.Generic

Why this verdict

The malicious score of 86/100 is the fusion of 1 weighted signal:

• ClamAV (daily) flagged Win.Malware.Renos-10003934-0 (rule Win.Malware.Renos-10003934-0) - engine signal, weight 0.90, confidence 0.95

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://oracle.com/contracts

Embedded domains

• oracle.com
• howtotell.com
• support.microsoft.com
• microsoft.com

More Renos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report