MALICIOUS — virussign.com_343e96bcc3e0e46ca21c9a610ce28260.vir

MALICIOUS — virussign.com_343e96bcc3e0e46ca21c9a610ce28260.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Autorun family. 7 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 9873f16cbc8fea4630d7d0f63dfa2a9391344895c7c99cf1f3a9277814178ae2
SHA-1: 2ec447faa3cb1325bc51923f1a2a9731f8582355
MD5: 343e96bcc3e0e46ca21c9a610ce28260
imphash: 178689c38c1294cbf87aafcafb2357ed
ssdeep: 24576:T+9C0XrUMFDsTB6vGPG2LW+P+mzRe+rYsVbjVljQkaZkCikpAhKDyJ:q9C0Xgfe2DRe+rZVbjHGit5J
TLSH: T18C5433CE53314845EEC7AA98B1734E0DB854065D0BB9D23B7BF80EC156512BF0636EA8
Submitted as: virussign.com_343e96bcc3e0e46ca21c9a610ce28260.vir
File type: pe · Size: 1174623 bytes
Verdict: malicious (100/100) · Family: Autorun

Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Worm.Socks-9892592-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/Autorun
Emsisoft (Emergency Kit): Trojan.Stealer.557
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Worm.Socks-9892592-0 (rule Win.Worm.Socks-9892592-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 25 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9526 behavior events · 3 ATT&CK techniques · 27 dropped files.

Dropped files

C:\Users\analyst\Local Settings\Application Data\cftmon.exe - 51279467b6a0a9a53a16bc8d184d7aff2334da35f76d535c09b15f72679dbbc0
C:\Windows\System32\Drivers\spools.exe - fa5b9a3f0f65a2e09beb3c3c1b3e890549ea323b9aae7f784917eb8dac86404a
C:\stop - 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - 6746f3daed8e01ed493704166f3d5ee25067ea458ae1c1f9790ed3ac37b446f8
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - c463b8ad61521f1650c74dd8227802801e36cecb92117845528bd5340bd1d823
C:\Windows\System32\Drivers\spools.exe - e07d14881d1bd668209cfde84f3012f17674ceaea459b2a07a0db04ed4ee9c91
C:\Windows\System32\Drivers\spools.exe - 7ec137b39fc25370758e5764dbfbe426210deb7425d77a00757047f917dbcd4d
C:\Windows\System32\Drivers\spools.exe - 02d6de8e7b8f51af2d4c9951e1e438d0417029fea6f7e799d20bf5777cd3baad
C:\Windows\System32\ftp33.dll - 708e375cb5fe09d4bbd61dd5622f3ce1b5a11c5c4648cb7c4ce87d96f9c6151c
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - b3996c105309530365da72f6b24b3f1d5bbff68c3c744e1c64dc34a47257a9a5
C:\Windows\System32\Drivers\spools.exe - 013124217188eb4c6897b2dafb186eb206dc9a74673849fab568e877e47cdeab
C:\Windows\System32\Drivers\spools.exe - cc47260c02f911454d11d6d615246c84467c65d70e6a98929bd99ee8055fc3b8
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - 774437f8acb978dfb7f30184653350b044743414a6768d80966f3845961f6bb1
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - 9e2cedd0c3290b40d331a357298b6895d38ad282026f7087d28d9786931783e9
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - 754a9a33823d85ea05fbfc351771503334212a895de807c5e35ea74a69cdf786

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787936759&P2=404&P3=2&P4=m42Vh5W24EJrLriVi%2b4InMweokAwlxN5ZUn3gZ7JX8M5LKEkQy5IuAZ3gCz%2fXL4x0PYA9h0HI2jOkQQKWl8udQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://bublikiadministrator.com/?&v=old_load&s=26246
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787936810&P2=404&P3=2&P4=GoWgu2kvlA0LiGhcymzWIrgIXPXoSxbxbWLd5%2bj8kpqx9P%2b9e5YJJiMmCYHkwcoCLOKV92M0N3RWB9e8brBKuQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ha.ru
bublikiadministrator.com
bublikimanager.com

Embedded IP addresses

20.42.65.89
20.42.179.204
4.230.171.124
4.144.132.114
20.165.94.63
20.165.94.54
13.89.179.15
40.99.134.18
20.236.44.162
52.123.129.14
52.123.128.14
172.66.2.5
20.50.201.195
203.26.79.13
74.178.76.44
135.233.45.221
92.223.78.30
193.166.255.171
52.123.252.246
20.184.175.4
52.148.114.188
52.123.252.233
162.159.142.9
72.153.5.131
52.110.12.47

More Autorun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report