SUSPICIOUS — billionprima.com.my-ssl_log-Oct-2026
SUSPICIOUS — billionprima.com.my-ssl_log-Oct-2026 is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (60/100), attributed to the Group10 family. 1 of 54 detection engines flagged it.
Identification
- SHA-256:
63f3c8651c82fd76f1f2ed91c5f152f0e5d450b4da60c701b89d33dd2208ea85 - SHA-1:
f646487b42c4b6d025b2861804658fd8cfd25603 - MD5:
cef59f57fcfc6af307f0661e829b8057 - ssdeep:
49152:+7A31dbxfL6sjqSeWsXXCLzLt2SHbvnWD3TcX1hxAwZ7BT/3:d - TLSH:
T19076534F60B5A8826D53CFA16590A8B4120AE4CE86417FC60FD09DE7BDE9B6F04CD643 - Submitted as: billionprima.com.my-ssl_log-Oct-2026
- File type: unknown · Size: 30051961 bytes
- Verdict: suspicious (60/100) · Family: Group10
Detections (1 of 54 engines)
- YARA: ESET research: IIS_Group10
Why this verdict
The suspicious score of 60/100 is the fusion of 2 weighted signals:
- YARA: ESET research flagged IIS_Group10 (rule
IIS_Group10) - engine signal, weight 0.70, confidence 0.70 - Embedded network infrastructure: https://billionprima.com.my/wp-login.php, https://billionprima.com.my/newbillion/wp-login.php, https://billionprima.com.my/ - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://billionprima.com.my/wp-login.php
- https://billionprima.com.my/newbillion/wp-login.php
- https://billionprima.com.my/
- https://billionprima.com.my/newbillion/
- https://billionprima.com.my/newbillion/contact-us/
- https://billionprima.com.my/newbillion
- http://billionprima.com.my/000.php
- http://billionprima.com.my/wp-content/about.php
- http://billionprima.com.my/wp-admin/css/admin.php
- http://billionprima.com.my//wp-admin/css/about.php
- http://billionprima.com.my/wp-content/wp-setting.php#admin@admin
- http://billionprima.com.my/wp-includes/hp2.php
- http://billionprima.com.my/bless.php#888xyz999
- http://billionprima.com.my/wp-content/goods.php
- http://billionprima.com.my/blurbs.php#888xyz999
- http://billionprima.com.my/wp-admin/css/goods.php
- http://billionprima.com.my/abcd.php
- http://billionprima.com.my/wp-admin/css/colors/wp-login.php
- http://billionprima.com.my/dex.php
- http://billionprima.com.my/wp-admin/admin-ajax.php
- https://billionprima.com.my/wp-admin/admin-ajax.php
- http://billionprima.com.my/wp-admin/css/index.php
- http://billionprima.com.my/wp-admin/index.php
- https://billionprima.com.my/wp-admin/index.php
- https://billionprima.com.my/newbillion/wp-admin/index.php
Embedded domains
- binance.com
- docs-cortex.paloaltonetworks.com
- anthropic.com
- shortpixel.com
- www.google.com
- www.apple.com
- openai.com
- unibocconi.it
- webmaster.petalsearch.com
- mj12bot.com
- ahrefs.com
- opensiteexplorer.org
- moz.com
- env.dev
- env.live
- www.facebook.com
- developer.amazon.com
- www.jora.com
- www.semrush.com
- ggpht.com
- help.coccoc.com
- favi.sh
- reflection.ai
- www.baidu.com
- bytedance.com
Embedded IP addresses
- 185.79.30.55
- 54.38.200.157
- 185.19.40.194
- 77.90.185.5
- 113.197.35.45
- 37.59.112.122
- 49.235.161.59
- 178.128.122.173
- 157.20.32.171
- 43.167.245.18
- 213.32.19.195
- 205.210.31.59
- 82.88.168.213
- 200.119.193.236
- 216.73.217.69
- 212.79.110.18
- 168.119.110.23
- 201.141.25.108
- 194.9.111.32
- 67.11.111.158
- 79.130.92.122
- 205.169.39.57
- 31.171.237.108
- 34.79.237.173
- 143.244.57.82
More Group10 samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report