MALICIOUS — virussign.com_dc6b9c6adc7d985d1009d555bdbe9e10.vir

MALICIOUS — virussign.com_dc6b9c6adc7d985d1009d555bdbe9e10.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the ClipBanker family. 5 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 41c529b64e5c238182210603564590a0ccdde6273508449c5e355837d43a7d16
SHA-1: 242c5ca3b4c1d4dd73bb0fc18e2bf92a97c15ca1
MD5: dc6b9c6adc7d985d1009d555bdbe9e10
imphash: ed8b780a3ce7ca4aba78a21f6bc3d4e0
ssdeep: 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8U:T6BJUoROZfIA8Xf8xumvBh8huTEEmr
TLSH: T190675CE456432111D1F9C808F431C4ECC87B789E96B19E8D0397E46950EBFBFAAE1099
Submitted as: virussign.com_dc6b9c6adc7d985d1009d555bdbe9e10.vir
File type: pe · Size: 6853194 bytes
Verdict: malicious (100/100) · Family: ClipBanker

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (5 of 56 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: PhishingKit (t4d): PK_Credential_Exfil_Telegram
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: flagged
Kaspersky (KVRT): HEUR:Trojan-Banker.Win32.ClipBanker.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

2 behavioral detection(s) across 2 rule(s): Defense Evasion: disable AV / Defender [high] (rule tl-defender-tamper) - dynamic signal, weight 0.63, confidence 0.90
YARA: PhishingKit (t4d) flagged PK_Credential_Exfil_Telegram (rule PK_Credential_Exfil_Telegram) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Banker.Win32.ClipBanker.gen (rule HEUR:Trojan-Banker.Win32.ClipBanker.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://go.dev/issue/66821, https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size, 5.4.62.5 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (9 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12951 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_ms2rej35.duh.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

Embedded URLs

https://go.dev/issue/66821
https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

big.int
abi.name
pkix.name
godebugs.info
github.com
golang.org
json.name
api.telegram.org
go.dev
steamcommunity.com
runtime.link
reflectlite.rtype.name
unicode.to
eq.io
go.shape.int
eq.net
hash.net
exec.in
eq.golang.org

Embedded IP addresses

5.4.62.5
4.32.5.4
52.5.4.72
5.4.82.5
5.4.102.5
4.112.5.4
1.1.1.1
20.247.185.124
51.116.253.168
4.230.171.124
74.178.240.51
4.150.223.106
40.84.85.40
135.233.95.144
104.18.33.89
52.110.12.47
52.110.12.32
135.234.160.245
52.148.114.188
20.184.175.6
20.42.65.88
72.154.7.107
52.110.12.50

More ClipBanker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report