MALICIOUS — virussign.com_c4e383526b81840969cb51abe1e94910.vir

MALICIOUS — virussign.com_c4e383526b81840969cb51abe1e94910.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Nemucod family. 6 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 25646c8c93ebf9b5b7de36fe5d81598677924baeafe1d61fbba2ec92c716ea62
SHA-1: 9f8a2be0757782fecab448824a17292de8ce2077
MD5: c4e383526b81840969cb51abe1e94910
imphash: 84706849fa809feaa385711a628be029
ssdeep: 3072:hs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/W/Fnncr5Q:hDeM7iNEkgiOb31k1EC4JqQ
TLSH: T1013E4B8D21487A96F2A54C24FC0949FE421FA8DA71F5FFA42937C01F76BE52BA301125
Submitted as: virussign.com_c4e383526b81840969cb51abe1e94910.vir
File type: pe · Size: 142362 bytes
Verdict: malicious (99/100) · Family: Nemucod

Source: VirusSign · first seen 2026-07-28T00:00:00.000Z · SHA-256 verified

Detections (6 of 51 engines)

ClamAV (daily): Win.Malware.Cymt-10023133-0
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
Kaspersky (KVRT): UDS:Backdoor.Win32.Agent
Microsoft Defender: TrojanDownloader:Win32/Nemucod
Emsisoft (Emergency Kit): Trojan.Agent.CYZT
Trellix Stinger (McAfee): Downloader-FCJE!C4E383526B81

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Malware.Cymt-10023133-0 (rule Win.Malware.Cymt-10023133-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Cymt): bc8ae95aff73b0ee01926a1abbd2c4a00ad8e868e3caeee9a8baaf2124450e03 - dynamic signal, weight 0.80, confidence 0.90
Contacted 61 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://wecan.hasthe.technology/upload, http://curl.haxx.se/docs/http-cookies.html - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

224 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/27652/files/bc8ae95aff73b0ee01926a1abbd2c4a00ad8e868e3caeee9a8baaf2124450e03 - bc8ae95aff73b0ee01926a1abbd2c4a00ad8e868e3caeee9a8baaf2124450e03
/opt/CAPEv2/storage/analyses/27652/files/888dd4f96f63c9db306d32ed13673d535bf7a63053e86bcf3bbd5a1bfd260b97 - 888dd4f96f63c9db306d32ed13673d535bf7a63053e86bcf3bbd5a1bfd260b97
/opt/CAPEv2/storage/analyses/27652/files/65db3fb5649b175c085930c165dd11d010df1b72bba7fdd7de8092485c90e263 - 65db3fb5649b175c085930c165dd11d010df1b72bba7fdd7de8092485c90e263

Embedded URLs

http://wecan.hasthe.technology/upload
http://curl.haxx.se/docs/http-cookies.html
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

example.com
curl.haxx.se
wecan.hasthe.technology

Embedded IP addresses

20.42.65.90
4.144.132.223
85.210.193.152
4.230.171.124
57.155.104.224
74.178.240.61
4.247.188.233
20.184.175.7
20.236.44.162
135.233.45.221
48.211.4.16
20.76.201.171
4.150.223.114
52.123.252.240
135.232.92.97
74.179.77.204
52.123.252.194
172.67.183.40
104.21.59.199
20.42.65.94
52.123.252.238
52.123.252.233
135.233.45.223
203.26.79.13
72.145.35.108

More Nemucod samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report