MALICIOUS — virussign.com_48e0156bc946e6e0dd3abd5a9a169e70.vir

MALICIOUS — virussign.com_48e0156bc946e6e0dd3abd5a9a169e70.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ulise family. 7 of 55 detection engines flagged it, exhibiting 8 ATT&CK techniques.

Identification

SHA-256: 71d9819183e5a1f4657553405f2ca4c3d067e4a539e33f192e05e1bf14cd9c19
SHA-1: 1bb4523dc1c8a52d204c777001501d6980f27930
MD5: 48e0156bc946e6e0dd3abd5a9a169e70
imphash: ec52c83a9dcd4904ac9c21e455dad213
ssdeep: 24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWYN:ho0c++OCokGs7Adgrd1f26RNYN
TLSH: T14F56AE99C252174DDAD9A30090FD4B9D2427F4F424F61FD882C3601A59EB4DBA872FE2
Submitted as: virussign.com_48e0156bc946e6e0dd3abd5a9a169e70.vir
File type: pe · Size: 1461074 bytes
Verdict: malicious (100/100) · Family: Ulise

Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Ulise-7135679-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/NetWire!pz
Kaspersky (KVRT): Trojan.Win32.NetWire.bh

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Trojan.Ulise-7135679-1 (rule Win.Trojan.Ulise-7135679-1) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Scheduled Task / Job [medium] (rule tl-scheduled-task) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 23 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001, T1497 - dynamic signal, weight 0.40, confidence 0.75
Extracted NetWire config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 192.0.2.2 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

63992 behavior events · 2 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Blasthost.exe - 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
C:\Users\analyst\AppData\Roaming\aepic\RtDCpl64.exe - a6f6f990bbaded756764bee27b76e0c01548acaa79bf52e9d6f9d3ef68da48f8
62f294471be79fb8868dc59200654a60b53485d2b28d40764406ccab80057724 - 62f294471be79fb8868dc59200654a60b53485d2b28d40764406ccab80057724
32a58913e64521816460792ef9a6ee5ab92ed2c3394605dc7bada3a5afe61590 - 32a58913e64521816460792ef9a6ee5ab92ed2c3394605dc7bada3a5afe61590
0955905c5cc99cbe2299f8e376137cb1b229ebed28a3684dae1882fdb11ef044 - 0955905c5cc99cbe2299f8e376137cb1b229ebed28a3684dae1882fdb11ef044
b5ee3cccea730c88b32a30f296cdde40789b286621c8382872dcfd85b71c073e - b5ee3cccea730c88b32a30f296cdde40789b286621c8382872dcfd85b71c073e
a064a289efccc7c8e790e3bef2c02dfd23064b07f0df44998cc99f5b9c0636a4 - a064a289efccc7c8e790e3bef2c02dfd23064b07f0df44998cc99f5b9c0636a4
627735e5337cb812cc4799ad67c9d4d734a1854fe2e85582bf5889dd29d3fc86 - 627735e5337cb812cc4799ad67c9d4d734a1854fe2e85582bf5889dd29d3fc86
021d01fe3793879f57a2942664fc7c096710e94e87ad13dc21467c12edf61546 - 021d01fe3793879f57a2942664fc7c096710e94e87ad13dc21467c12edf61546
9f50debb6a78fe7582dfbf7ca2366871d68878c5728aa01a943b926604c81d55 - 9f50debb6a78fe7582dfbf7ca2366871d68878c5728aa01a943b926604c81d55
fd4909a0d0e5131837de9bbbe953ea38f87efb2a9db4139b446a75f98b6da2f3 - fd4909a0d0e5131837de9bbbe953ea38f87efb2a9db4139b446a75f98b6da2f3
bc50dbf3c6aa95a56f740aa1a0dbacc7c4ab31fa68fd463f74fc862dd004e37d - bc50dbf3c6aa95a56f740aa1a0dbacc7c4ab31fa68fd463f74fc862dd004e37d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787936168&P2=404&P3=2&P4=QmazjN5%2bXQtmHufqso69IlnXiajC3myvB0zTO8fi8kqAcosb8705URFMEuGqqoDPZaSImtfq2RWrmw5uLhhflg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787936233&P2=404&P3=2&P4=NBYF6mfa5S0HC%2fx06hf9dLn9W1wiU3%2f0%2bvpqmtusXOOoPJjCGUmhE9%2fHaHDdmlGEW%2fyEZXta3A9N5UhpXDL3ng%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

wealthy2019.com.strangled.net
wealthyme.ddns.net
wealth.warzonedns.com

Embedded IP addresses

192.0.2.2
40.79.150.120
172.215.188.232
4.230.171.124
4.144.132.114
74.178.76.128
4.207.44.72
74.178.240.51
20.236.44.162
52.123.128.14
52.123.129.14
4.150.223.115
203.26.79.13
20.165.94.46
135.234.160.245
92.223.78.30
52.148.114.188
34.41.139.193
52.123.252.234
172.178.240.163
72.145.35.102
74.179.71.159
52.110.12.24
52.110.12.16

File paths

R:\:f:m:q:w:{:
V:\:`:f:p:z:
T:\:d:l:t:
X:\:`:d:h:l:p:t:x:

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report