MALICIOUS — virussign.com_6dda268047b91004bd9ff3213c8dfb20.vir

MALICIOUS — virussign.com_6dda268047b91004bd9ff3213c8dfb20.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (74/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 837e28ef6e36eaa97bd1681b1e0a05fe644af3d2c208abf77d39d481ec8d3868
• SHA-1: f0da9f16ac6f493c50e903f05b5dd3ca502681bd
• MD5: 6dda268047b91004bd9ff3213c8dfb20
• imphash: 3801cf0cc42427f1569fb78d2d1b45a8
• ssdeep: 12288:vUdBBDjUrEdXlzy/iFf+jLHothYA1s9WYFIh9qB8P/pwrIwIKKWr37b1:MUrSCiFf+jLHobYAEb+KrxVrV
• TLSH: T16952290015037AABE7EBB7111831579CF61772BD26692B582F1AD01E406FF378BD248A
• Submitted as: virussign.com_6dda268047b91004bd9ff3213c8dfb20.vir
• File type: pe · Size: 1002085 bytes
• Verdict: malicious (74/100) · Family: HUILoader

Source: VirusSign · first seen 2026-08-19T00:00:00.000Z · SHA-256 verified

Detections (6 of 55 engines)

• capa (capabilities): capability:collection/keylog
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
• Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
• Trellix Stinger (McAfee): Trojan-FXIH!6DDA268047B9
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1057
• T1056.001

Why this verdict

The malicious score of 74/100 is the fusion of 5 weighted signals:

• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 21 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.7-zip.org/ - static signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

32 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• to-do.office.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• ctldl.windowsupdate.com
• login.live.com
• ocsp.digicert.com
• settings-win.data.microsoft.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• oneocsp.microsoft.com
• www.msn.com

Dropped files

• a1f415e07c470618508d7bb1211f5d1f06ce878fe1f54a8cb2ede15ffd7244fa - a1f415e07c470618508d7bb1211f5d1f06ce878fe1f54a8cb2ede15ffd7244fa

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.7-zip.org/
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• ug.mi.oc.co
• schemas.microsoft.com
• www.7-zip.org

Embedded IP addresses

• 20.42.179.192
• 4.150.223.103
• 4.230.171.124
• 4.144.132.114
• 74.178.240.61
• 74.179.77.164
• 4.150.223.107
• 20.236.44.162
• 40.99.134.2
• 40.99.133.226
• 52.123.128.14
• 52.123.129.14
• 52.168.117.168
• 135.234.160.246
• 135.234.160.245
• 72.145.35.99
• 52.148.114.188
• 162.159.142.9
• 74.179.71.159
• 52.110.12.33
• 52.110.12.45

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report