MALICIOUS — virussign.com_f7330d94c37439a56464335746ea73d0.vir

MALICIOUS — virussign.com_f7330d94c37439a56464335746ea73d0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Psixbot family. 5 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 31bd1a9f7fcb25a5e4588e2131a12d2cf6b412ee12b3da6f433aa6e10b8de894
SHA-1: 05612c6f4fb5fb121aefc75c1048de1dd0d5407c
MD5: f7330d94c37439a56464335746ea73d0
imphash: 8fecd48a2a2309d9acd4f1e6ab7123d1
ssdeep: 3072:YYYhFHyhSRaCO6woDjXNGWB0+IF6foPCaTRMXbaev0FQcmWk6kwsNIf6cHzbQ2v:Y3/Sc/O6w4/0+IFZMbQrkodzb4Pv2Yd
TLSH: T1E84D6CCE9119679FDA379E113850D9AE2496F8C6D8B53F0C0A86843A3592C1BFC3245B
Submitted as: virussign.com_f7330d94c37439a56464335746ea73d0.vir
File type: pe · Size: 582659 bytes
Verdict: malicious (99/100) · Family: Psixbot

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

capa (capabilities): capability:execution/powershell
ClamAV (daily): Win.Malware.Psixbot-9917128-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Kaspersky (KVRT): HEUR:Backdoor.Win32.PsixBot.gen
Microsoft Defender: Trojan:Win32/PsiXBot!pz

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Psixbot-9917128-0 (rule Win.Malware.Psixbot-9917128-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://checkip.dyndns.org/, http://rrradiusspace.bit/, http://spinner.bit/ - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

25735 behavior events · 2 ATT&CK techniques · 19 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\audiohd.exe - dc0d87804c4acd08387f38ecabb6762a68cc460467a359b7e3195e68c62f3193
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_nyryzu0s.lo2.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - 62412e29f97158385358377da9860e0e4cd8d6b509a1d0457b15da59e1bcbb8e
C:\Users\analyst\AppData\Local\Microsoft\local.cs - 6da3e26b268e4a6c21e192c8b9a1b89aef6880bad673b79e6a889d29641ac2cc
8dae667d5e66031852a22123c584967d301b06c2d7a7273d92fabb1d92bda980 - 8dae667d5e66031852a22123c584967d301b06c2d7a7273d92fabb1d92bda980
6f5aaa92006814a4672db69ebff7d5efd3e9fbb8d9995f2919f80bdd3d259a27 - 6f5aaa92006814a4672db69ebff7d5efd3e9fbb8d9995f2919f80bdd3d259a27
6f75025703f776ba85e0747950381154bef27be62c79048e996827cb69fcbaad - 6f75025703f776ba85e0747950381154bef27be62c79048e996827cb69fcbaad
8ae60e4b449656afb53976d5e27ec74f69af507df84d4b7b81254314fb0940d1 - 8ae60e4b449656afb53976d5e27ec74f69af507df84d4b7b81254314fb0940d1
d8ff16fd7f753412bee3961d6ca57f5167c89e6ef92f03fba599483bf80d317c - d8ff16fd7f753412bee3961d6ca57f5167c89e6ef92f03fba599483bf80d317c
7ff22075c65ae2ca2406b99554a48bc56ba27006db08a1d7e2ab8252f9251304 - 7ff22075c65ae2ca2406b99554a48bc56ba27006db08a1d7e2ab8252f9251304
fe6682c4532056ccd80c4513485d3973708cf9c2516d7f507a7611e37998bc08 - fe6682c4532056ccd80c4513485d3973708cf9c2516d7f507a7611e37998bc08
1e6256980d9a6882f1db94a3d369ec0351ac529d76abdbbc3ed1149a91c81ef6 - 1e6256980d9a6882f1db94a3d369ec0351ac529d76abdbbc3ed1149a91c81ef6
bb77f1d6ff549c08d15ccbdad6cf1a418295d3c45b719b30f506c5ed73242693 - bb77f1d6ff549c08d15ccbdad6cf1a418295d3c45b719b30f506c5ed73242693
3dce0698ac738814a25fb276bd7bbf9b44e3795a17749a3171d27073b067945e - 3dce0698ac738814a25fb276bd7bbf9b44e3795a17749a3171d27073b067945e
9ffc26d21c5627f698a7c7b2f87dcd8dc44b10b690aa97863f6645e80d2992c0 - 9ffc26d21c5627f698a7c7b2f87dcd8dc44b10b690aa97863f6645e80d2992c0

Embedded URLs

http://checkip.dyndns.org/
http://rrradiusspace.bit/
http://spinner.bit/
http://getreserv.su/safedomain.txt
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787849764&P2=404&P3=2&P4=WwS8Dgblj3VFT53aDrNVoUrWXHJXgUZ%2bNE1gQWVxcNE%2f7rTh3hX4vTQI5ISu8KI39vPx5XX4j54VoejiArYLaA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787849870&P2=404&P3=2&P4=LSjX%2fFUDhn6UFh4lKVHMan9x9G%2bhelb1YAFg5davf2I9F5U6DF%2fL4n%2fKg5eg2E3pnWfUix0QnBBsuCaBzo0xGw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

checkip.dyndns.org
dns2.soprodns.ru
dns1.soprodns.ru
getreserv.su
rrradiusspace.bit
spinner.bit

Embedded IP addresses

5.154.191.67
185.121.177.177
169.239.202.202
198.251.90.143
111.67.20.8
163.53.248.170
139.59.17.152
142.4.204.111
142.4.205.47
158.69.239.167
192.99.85.244
31.3.135.232
31.171.251.118
81.2.241.148
62.113.203.99
37.58.63.27
130.255.78.223
144.76.133.38
82.141.39.32
139.59.208.246
172.104.136.243
130.255.73.90
195.154.226.249
212.47.242.157
87.98.175.85

File paths

G:\WORK\MONEY\BOT\NoName\PsiX\obj\x86\Release\source2.pdb
c:\users\user\source\repos\WindowsProject1\Release\WindowsProject1.pdb
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Program
C:\Windows\SysWOW64\WindowsPowerShell
C:\Windows\explorer.exe

More Psixbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report