MALICIOUS — virussign.com_bc5ba7beb49f56d2a1cecdecf0638740.vir

MALICIOUS — virussign.com_bc5ba7beb49f56d2a1cecdecf0638740.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Guap family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 400ceca0f16a41e4feaa86832442b44349c26b1ff29cbf90eab93e1c7c6c79fb
SHA-1: 12470e75b3bfdb714fd22b9e0a17675cf7d11436
MD5: bc5ba7beb49f56d2a1cecdecf0638740
imphash: b6230692891661869cecd581561a21f4
ssdeep: 12288:zW6n3sX4yCFr2ZemYOpSPIsGWeKZl4q7sioXw:zW6ncoyqOp6IsTl/mXw
TLSH: T1CF4CBED87AC7CD54E8E97B86E44554BDD68BD12F582D2E8F0392C2386F812F3A472112
Submitted as: virussign.com_bc5ba7beb49f56d2a1cecdecf0638740.vir
File type: pe · Size: 534758 bytes
Verdict: malicious (100/100) · Family: Guap

Source: VirusSign · first seen 2026-08-20T00:00:00.000Z · SHA-256 verified

Detections (6 of 55 engines)

ClamAV (daily): Win.Worm.Guap-4
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
Kaspersky (KVRT): Trojan.Win32.Fsysna.gevi
Microsoft Defender: Trojan:Win32/Fsysna!pz
Emsisoft (Emergency Kit): Gen:Heur.Spesr.VB.1

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Worm.Guap-4 (rule Win.Worm.Guap-4) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 16 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

66465 behavior events · 3 ATT&CK techniques · 24 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\TempEABKY.bat - 5514357bfdcb16a56c5d71aa333d917608c5c1ceff923540c063a2a7dcde319c
C:\Users\analyst\AppData\Local\TempCJXFS.bat - 17006860873193d8f88448dcf0fa02d3bea3131750dc6e3e91f94370088f80a5
C:\Users\analyst\AppData\Local\Temp\LOEWUDXMCIQHGRO\service.exe - 9eff60c01d1f82f2d382bd2d5e290d91c0dc5d4e9a2dd8f57f0c39da5a81be6d
C:\Users\analyst\AppData\Local\Temp\OQGAYWFOFPIHJWW\service.exe - ba3b26ca2bf23b52294ad28b6d8ede1c225b1448bcf034aa7648e700050a97de
C:\Users\analyst\AppData\Local\Temp\XQPXLKMHFMHXLSB\service.exe - c90f90304c4cc4775428ab989b1faf8eecf84b974ec959eff13ec15363b44909
C:\Users\analyst\AppData\Local\Temp\NVJIKFDKFVJQLPM\service.exe - 61599edcd2d332bbc978395aee5d0b41583bbea0bdb6a900bdedc487cb54be0c
C:\Users\analyst\AppData\Local\TempROWIP.bat - 790899a59a6e414c9c1dc7b5f4b017f73779c7554b4a6419f49edf6129250f3c
C:\Users\analyst\AppData\Local\TempIACQL.bat - 66332c25e590747d69a50a7fb0a2aead42afa17930605e2672200addff528242
C:\Users\analyst\AppData\Local\Temp\YRQAYMMNIGNJMTD\service.exe - d89a8bfb714e8d0f71d226879c6c5fea63d802c446c8dcf053386df26e3d25ff
C:\Users\analyst\AppData\Local\TempRUVHI.bat - 53e503bf1b1af92b37cd9a65963faee921eaa8479610f6c177f8af4b577b21ed
C:\Users\analyst\AppData\Local\Temp\FYIUTVQOVQGUBKB\service.exe - 61f37f2d11f5b8ff8bc4e146dcce4ba302c0fe3d48bf1c47178b7d157a93d6aa
C:\Users\analyst\AppData\Local\TempMLPCG.bat - 6cc2f0789d21f94c72dac21ff6a1912ed79f03ceca26465208d3725057eb1c71
C:\Users\analyst\AppData\Local\Temp\XEWGSSTOMTPESAJ\service.exe - d9cb30b5bb6fc25e81cad91657ea053aaa5b2420c96beb36c47a27e7873440ca
C:\Users\analyst\AppData\Local\Temp\NFVEMBABWCSNAIC\service.exe - dd029fc1abc9c3c137854ea8ce7622fcea574f148ceeea1d366ff3549cd200ae
C:\Users\analyst\AppData\Local\TempTRHHJ.bat - bc1fca60b5010fe3cfb29140f3af437660d56a414f2a5cfb0378211b0a89acbe

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787849785&P2=404&P3=2&P4=kNQMkfmOr%2bSYMMmK44mBiPkktdbARnqtD0UUEl4U7K42TRrLuWOvuKHurAbe6tC1puhlBZhhVHnJ1kYjm%2fevqQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787849894&P2=404&P3=2&P4=eaOc4X%2fsx%2fXdtoRSizRoNXQuJkcW9Dt%2bbnjtqC39Vl9Bdjw7FZlwCb6BvHeShLB7pElO2Twacnp39M8mKCBEUg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

server.com
tsymantec.com
tsecurityresponse.symantec.com
tsarc.com
twww.sarc.com
twww.sophos.com
tsophos.com
twww.mcafee.com
tmcafee.com
tliveupdate.symantecliveupdate.com
twww.viruslist.com
tviruslist.com
tf-secure.com
twww.f-secure.com
tf-prot.com
twww.f-prot.com
tkaspersky.com
tkaspersky-labs.com
twww.avp.com
tavp.com
twww.kaspersky.com
twww.networkassociates.com
tnetworkassociates.com
twww.ca.com
tca.com

Embedded IP addresses

20.184.175.10
4.247.188.224
4.230.171.124
52.230.59.222
74.178.240.61
74.179.77.164
20.42.73.28
20.236.44.162
40.99.133.226
52.123.128.14
52.123.129.14
40.99.133.242
52.182.141.63
135.234.160.244
92.223.78.30
172.178.240.162
203.26.79.13
52.148.114.188
74.178.76.44
52.123.252.218
72.153.5.62
20.165.94.46
52.110.12.20
52.110.12.49

Registry keys

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

File paths

C:\Program
C:\WINDOWS\system32\drivers\etc\hosts

More Guap samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report