MALICIOUS — virussign.com_c87aa1f933e91f2e6a4a4e2ef45d0350.vir

MALICIOUS — virussign.com_c87aa1f933e91f2e6a4a4e2ef45d0350.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PesidiousMutator family. 9 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 9f94db81a05b992208260aa15e218899249e6c55c99d4195cc732f82626d4d25
SHA-1: 967dfa2804ce838de2a1d0bcc41abd516e6c6cb6
MD5: c87aa1f933e91f2e6a4a4e2ef45d0350
imphash: 2a06fc063f55978f1c608f68f137a128
ssdeep: 24576:ulVetXEiI71JOXcyZDjJuiNUb9O2rw9NQx2KRKXaTfdOH53hEdSgWv:ulVepEiIRoTDjcibm8XKsqTfEBo+
TLSH: T1205C7C73F4115DD5CB05B336844678EE467339BB08E8E1844626E646BED8FA33AB610C
Submitted as: virussign.com_c87aa1f933e91f2e6a4a4e2ef45d0350.vir
File type: pe · Size: 2444920 bytes
Verdict: malicious (100/100) · Family: PesidiousMutator

Source: VirusSign · first seen 2026-08-19T00:00:00.000Z · SHA-256 verified

Detections (9 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Razy-9857221-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Trojan:Win32/Injector.RAQ!MTB
Emsisoft (Emergency Kit): Gen:Variant.Lazy.720583
Kaspersky (KVRT): HEUR:Trojan.Win32.PesidiousMutator.gen

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9857221-0 (rule Win.Malware.Razy-9857221-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. process hollowing in tsk_c81a921bdf (pid 5384) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 29 external host(s) at runtime (29 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

8679 behavior events · 2 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D588C464E3D4F9F1F5D043A1B7C9A7E - 1fc36fb7d9502c53af6b4c3b0d11ba7e89f9f7b4d77ade25050c85379caeb899
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8AC0ED8906442A67C7B113D790F1875D - 1a0d1b7cfd7ffd3c157a05521ebd709e92dd519c57da3a83a7ccaaa676acf0b3
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 - a3d5f79e06442763d61accd6d0122216c3b7b0c4d20be92b1992f16b9206acf4
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8AC0ED8906442A67C7B113D790F1875D - 4836057945df61b1dfa0c9c8898bde04256d9cc8697b4eddba2cc487c5ad59da
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 - d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
C:\Users\analyst\AppData\Local\Temp\tsk_c81a921bdf86414f.exe - c0d6edf76dc1cbad6b404e1f114e111a43f92acd1ec3dcdaf8a7bbfca3e281e3
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D588C464E3D4F9F1F5D043A1B7C9A7E - 2f80e6992857d776a04789df9c1a13311ebf2a5d22791097f936cee8a02a85f6
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B625C9EE8BD3E6849AFA2339291AE3C - 2c057b177a9c2a9d08f8f8fcf4b9364c4f4d32c84e0202cb3203a3b075ba47af
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 553531805280aea0575fc6172003aad3ca1d3e3af39d0222d37abf9b2aa67e8a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B625C9EE8BD3E6849AFA2339291AE3C - cfebdec1cab632f7ff06d6178856b354f9822d06f95a17cbb137851465373866
5a3d8a96dedd4f418cfe1396557241c9a7fb35c1b2db4522c66f907599e139c3 - 5a3d8a96dedd4f418cfe1396557241c9a7fb35c1b2db4522c66f907599e139c3
7b81075316d261b96125b9d6760f8ba5383dc13dd9a750935bb4e3bd7deef22d - 7b81075316d261b96125b9d6760f8ba5383dc13dd9a750935bb4e3bd7deef22d
c2318e8a57cbdfd9910a7bd6c884938b542d5913caad6cb26c262293daa9cfd3 - c2318e8a57cbdfd9910a7bd6c884938b542d5913caad6cb26c262293daa9cfd3
306484095bf0fff242d2b7f8e52bce3b62ca122083c97748bc6c2df4a2224b10 - 306484095bf0fff242d2b7f8e52bce3b62ca122083c97748bc6c2df4a2224b10

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787782837&P2=404&P3=2&P4=Zb1ilQ%2f5MTF%2b4jY6EjVEYUcBxEoIO9IY6DH%2bhGmhz%2bl21xLv4CO5M7%2fibOkOcQJ37bbap9EZWyYjf1t2WjvAmg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787782857&P2=404&P3=2&P4=Ae0iB1rxx8CyLss%2fwXUkis%2bV8nvDUgqkVj%2faRe0h%2feIlHuShv6Dd8rDxd6zhwfi6C5ouSSxSPVmkBaAvQGsf0w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://zipansion.com/2pRLi
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/pyeoXlQPF4E.crl
http://c.pki.goog/we1/OpMCQT6sVwg.crl
http://c.pki.goog/we1/USODfqcOxVM.crl

Embedded domains

schemas.microsoft.com
zipansion.com
publisher.linkvertise.com
direct-link.net
linkvertise.com

Embedded IP addresses

4.150.223.114
4.230.171.124
4.144.132.114
85.210.196.11
135.232.92.34
135.232.92.137
135.233.95.135
4.207.44.73
203.26.79.13
52.123.129.14
20.112.250.133
40.103.64.226
52.123.128.14
135.234.160.245
52.148.114.188
52.110.12.2
52.110.12.30
72.154.7.109
85.210.193.152
20.42.65.84
52.168.117.170
92.223.78.30
104.18.1.75
172.67.217.63
172.67.144.180

More PesidiousMutator samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report