MALICIOUS — virussign.com_967cdf413145cb0f57486710c4284c70.vir
MALICIOUS — virussign.com_967cdf413145cb0f57486710c4284c70.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Lazy family. 3 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
6cbde4c646f6aa10c04c202810a36e05044728df2043124021e5ff72631a8eb6 - SHA-1:
787180b8b03548978e7bfdb2f9fa8d4ca18697c4 - MD5:
967cdf413145cb0f57486710c4284c70 - imphash:
8ba9fa2d172de02ce62b742cb8c2cce9 - ssdeep:
12288:qO4rfItL8HGuPlubV05FKKOl5QB4ZBZH4xw97bWmeEVGL:qO4rQtGGuzvKKOl5QB4WaumeEVGL - TLSH:
T1104BE154D244A651E973CAA13C818F1EB0E370EA24BD68DD57C3C50F6AFAD8FA412079 - Submitted as: virussign.com_967cdf413145cb0f57486710c4284c70.vir
- File type: pe · Size: 479407 bytes
- Verdict: malicious (99/100) · Family: Lazy
Source: VirusSign · first seen 2026-07-17T00:00:00.000Z · SHA-256 verified
Detections (3 of 53 engines)
- ClamAV (daily): Win.Packed.Lazy-10005437-0
- Microsoft Defender: TrojanDropper:Win32/Salgorea.AI!MTB
- Kaspersky (KVRT): HEUR:Backdoor.Win32.Salgorea.gen
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Packed.Lazy-10005437-0 (rule
Win.Packed.Lazy-10005437-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 5468) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged TrojanDropper:Win32/Salgorea.AI!MTB (rule
TrojanDropper:Win32/Salgorea.AI!MTB) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
143 behavior events · 2 ATT&CK techniques · 1 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- staging.to-do.officeppe.com
- www.bing.com
- tas02.sls.update.microsoft.com
- desktop-hsgcbep
- aps.prod.windows.com
- config.edge.skype.com
- dns.msftncsi.com
- settings-win.data.microsoft.com
- to-do.microsoft.com
- ctldl.windowsupdate.com
- staging.to-do.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- teams.microsoft.com
- 192.168.122.107
- 192.168.122.1
- 192.168.122.255
- 224.0.0.252
Dropped files
- /opt/CAPEv2/storage/analyses/3569/files/ccd7bc556817ae5e8f10dee6caaf98a82684643a09d1a0049a14e8e6b5ddad39 -
ccd7bc556817ae5e8f10dee6caaf98a82684643a09d1a0049a14e8e6b5ddad39
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
Embedded domains
- schemas.microsoft.com
- microsoft.com
- go.microsoft.com
- staging.to-do.officeppe.com
- searchapp.bundleassets.example
- www.msftconnecttest.com
- www.bing.com
- tas02.sls.update.microsoft.com
- aps.prod.windows.com
- config.edge.skype.com
- dns.msftncsi.com
- settings-win.data.microsoft.com
- to-do.microsoft.com
- ctldl.windowsupdate.com
- staging.to-do.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- teams.microsoft.com
More Lazy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report