MALICIOUS — virussign.com_80353f69e2562d7bc377e6e206fc8dc0.vir

MALICIOUS — virussign.com_80353f69e2562d7bc377e6e206fc8dc0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Berbew family. 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 55a4a044b0304d7f59602c0a4e12ed0cbcce3cb6a7ee2f94034f6be51be7cb5e
SHA-1: ef6a6e064c33b5c0d036f97e43d5c73a3c613040
MD5: 80353f69e2562d7bc377e6e206fc8dc0
imphash: 0ed11c14a2759c69bfa93dd64e1f1654
ssdeep: 48:6EQt5YVOSVVEPy+wEMmqiHNpU10bB+BDq9J5SV3DY:CSVVEPozmB7lB+FqX5S1D
TLSH: T1721E7392613345ACD27BC180FC939F1C6A71B452E2A9240CD90E6117D2CE53741A99FB
Submitted as: virussign.com_80353f69e2562d7bc377e6e206fc8dc0.vir
File type: pe · Size: 6657 bytes
Verdict: malicious (98/100) · Family: Berbew

Source: VirusSign · first seen 2026-07-18T00:00:00.000Z · SHA-256 verified

Detections (4 of 53 engines)

ClamAV (daily): Win.Trojan.Berbew-9845290-1
Microsoft Defender: Backdoor:Win32/Berbew
Emsisoft (Emergency Kit): Trojan.Qukart.1
Kaspersky (KVRT): Backdoor.Win32.Padodor.gen

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 98/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Trojan.Berbew-9845290-1 (rule Win.Trojan.Berbew-9845290-1) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7232) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Backdoor:Win32/Berbew (rule Backdoor:Win32/Berbew) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Qukart.1 (rule Trojan.Qukart.1) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded domains

staging.to-do.officeppe.com
searchapp.bundleassets.example
www.msftconnecttest.com
www.bing.com
config.edge.skype.com
tas02.sls.update.microsoft.com
dns.msftncsi.com
to-do.microsoft.com
settings-win.data.microsoft.com
ctldl.windowsupdate.com
staging.to-do.microsoft.com
edge.microsoft.com
teams.microsoft.com

More Berbew samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report