MALICIOUS — virussign.com_dbb0f07fd5c9d6bd4b66d86203189050.vir

MALICIOUS — virussign.com_dbb0f07fd5c9d6bd4b66d86203189050.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sytro family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 0f82d26e1327f712237eee7ed2ac9bfdd3b2ffe863c83ab0a8b8f00ec5b615a1
SHA-1: fe6351b665588edd109f522d6116d7c498d67006
MD5: dbb0f07fd5c9d6bd4b66d86203189050
imphash: 0e836bd3be54eeeafd05573d50eaca49
ssdeep: 1536:flNdxgtZHIy/bx02iPXXVVj+gBwoY3BXTBCqZ4qoVsYTPcqCiX4avTrrSG/L:flXxgtyWbxgXXVJ+vVNjeqoVsA0qCiBv
TLSH: T1A33802665432A5ABDEA1F473018FB41D2D01878F80B10FE4B55DC63A2BB842B937B52C
Submitted as: virussign.com_dbb0f07fd5c9d6bd4b66d86203189050.vir
File type: pe · Size: 79594 bytes
Verdict: malicious (100/100) · Family: Sytro

Source: VirusSign · first seen 2026-08-23T00:00:00.000Z · SHA-256 verified

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:RWbgtbqV
ClamAV (daily): Win.Worm.Generickdz-9820298-0
Microsoft Defender: Trojan:Win32/Kazadm.A!MTB
Emsisoft (Emergency Kit): Trojan.GenericKD.81102496
Trellix Stinger (McAfee): Sytro-FDX!34CBBDFE1AC6
Kaspersky (KVRT): P2P-Worm.Win32.Sytro.j

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Worm.Generickdz-9820298-0 (rule Win.Worm.Generickdz-9820298-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Kazadm.A!MTB (rule Trojan:Win32/Kazadm.A!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.81102496 (rule Trojan.GenericKD.81102496) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Sytro-FDX!34CBBDFE1AC6 (rule Sytro-FDX!34CBBDFE1AC6) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged P2P-Worm.Win32.Sytro.j (rule P2P-Worm.Win32.Sytro.j) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:RWbgtbqV (rule high-entropy-sections:RWbgtbqV) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:RWbgtbqV - static signal, weight 0.25, confidence 0.55
Dropped 50 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

334 behavior events · 0 ATT&CK techniques · 51 dropped files.

Dropped files

C:\Windows\Temp\Cat Attacks Child Full Downloader.exe - 2f902e1ec1b5a9a7eb9d4d351f8ce831b06893d027693625b912af0d49949cac
C:\Windows\Temp\AIM Account Stealer Downloader.exe - 7f99fbaaa908af1583c44ee09905f7528297d638f37e4a26e6c686ecceedb16e
C:\Windows\Temp\Shakira FullDownloader.exe - 45e2884ef34725e9581ead3c2ca291bfa02b9f6c659bc7e68f1e43350c9893ec
C:\Windows\Temp\PS1 Boot Disc Full Dwonloader.exe - 7fa4da455ebd782bc6cd66d89f095636601448ef97b85ec95f33ddf204f45d88
C:\Windows\Temp\LordOfTheRings-FullDownloader.exe - 11cb7015bda541adf15cf88b506a11afbf576d548d833a20b360a24aec8b4534
C:\Windows\Temp\GTA3 crack.exe - fa26359ed31cb1d3971dc89e1861eaed45064d52b00b9041718e90b6259a1139
C:\Windows\Temp\Hacking Tool Collection.exe - 0a3277a922a254da0018fe56617bc710e609479e28761437a71a48ae09704d4d
C:\Windows\Temp\Winzip 8.0 + serial.exe - d14874308bac4adad2a321bb78ab939ed499f522b9cd5e1de019de4e3a0eee0f
C:\Windows\Temp\ScaryMovie 2 Full Downloader.exe - 1d85f47b87e9e499df3de461d1d107d1243728ba29af345566ebc062d1a7e257
C:\Windows\Temp\Hack into any computer!!.exe - 1b8ec3526ecfd283269e960354bd01cb3c6c7c190f6a7765a9a274bb224e534d
C:\Windows\Temp\Windows XP key generator.exe - f7bf2d340b6d5b488ebafda62a9a2536334f7ea88c85bcac8a5ab412beed1a3b
C:\Windows\Temp\AikaQuest3Hentai FullDownloader.exe - 6bd2307996615eb8af2bffb29df25dd1e597025099a04745fc1bcf1b437f2bf3
C:\Windows\Temp\DivX.exe - 4151f60cdf9b189dfc9bed17d7ebaeffcdb8fff6646aa2e521a1091b9af3bc28
C:\Windows\Temp\Macromedia key generator (all products).exe - f2ca1307125fbcc705a1918503b055cd6f044e5d9a11f30372989c2fd136d65b
C:\Windows\Temp\Warcraft 3 ONLINE key generator.exe - 2a1002d621bc6fa03db12e2df0db90617db19d9976663d800bfe14407cd702a7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

40.74.98.198
52.123.252.198
4.230.171.124
20.42.179.204
52.230.60.54
74.178.240.51
4.150.223.97
74.179.77.204
74.178.76.128
20.42.65.88
52.110.12.24
52.110.12.1

More Sytro samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report