MALICIOUS — virussign.com_2ee59c59805f61b7699b19aab38698a0.vir

MALICIOUS — virussign.com_2ee59c59805f61b7699b19aab38698a0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the PowerShell family. 11 of 51 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

• SHA-256: aa5c738b0077a86e235f68cf0cf7ef2602bc7eabafb371bb6cdecb217c1ec3ab
• SHA-1: 5864efedb490964a4498fc00fd4ea3da18905cdd
• MD5: 2ee59c59805f61b7699b19aab38698a0
• imphash: 8ad69be5fca832eaa658b4ba57790aa2
• ssdeep: 24576:tw1FGGfwaWsesJHA/eJ7gQdFvoR8e2b5aDfT7dinS/J1qg3E:tw1FGGfdWsesJHAS7gQdFvoR8eIaDfT
• TLSH: T1AD56F89111173192C1BAFD44F53698DD8023B891B6708A8D970FE40CA2EDFF796F58A2
• Submitted as: virussign.com_2ee59c59805f61b7699b19aab38698a0.vir
• File type: pe · Size: 1444352 bytes
• Verdict: malicious (99/100) · Family: PowerShell

Source: VirusSign · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified

Detections (11 of 51 engines)

• YARA: MalwareAnalyser built-in: Suspicious_PowerShell_Download_Exec
• capa (capabilities): capability:credential-access
• YARA: delivr.to detections: DLV_LNK_PowerShell_Launcher
• YARA: Intezer community: INTEZER_Linux_Reverse_Shell
• YARA: JPCERT/CC: JPCERT_Emotet
• YARA: SophosLabs IoCs (public): SOPHOS_ChinaChopper_Webshell
• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
• YARA: MalwareAnalyser community pack: TL_Windows_Persistence_RunKey
• Microsoft Defender: HackTool:Win32/Mimikatz.NPTT
• Emsisoft (Emergency Kit): Trojan.GenericKD.81002984
• Kaspersky (KVRT): Trojan-Downloader.Win32.Agent.xydwga

MITRE ATT&CK

• T1059.001
• T1555
• T1003
• T1547.001
• T1056.001
• T1055

YARA

• Suspicious_PowerShell_Download_Exec
• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 99/100 is the fusion of 13 weighted signals:

• Encoded/hidden PowerShell download-and-exec (rule Suspicious_PowerShell_Download_Exec) - yara signal, weight 0.70, confidence 0.90
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_LNK_PowerShell_Launcher (rule DLV_LNK_PowerShell_Launcher) - engine signal, weight 0.35, confidence 0.70
• YARA: Intezer community flagged INTEZER_Linux_Reverse_Shell (rule INTEZER_Linux_Reverse_Shell) - engine signal, weight 0.35, confidence 0.70
• YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
• YARA: SophosLabs IoCs (public) flagged SOPHOS_ChinaChopper_Webshell (rule SOPHOS_ChinaChopper_Webshell) - engine signal, weight 0.35, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Windows_Persistence_RunKey (rule TL_Windows_Persistence_RunKey) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http:///payload.exe, 193.23.244.244, 171.25.193.9 - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http:///payload.exe

Embedded domains

• example.com
• config.network
• dataexample.com
• exfiltrationexfil.example.com
• chain.name
• bing.com
• baidu.com
• www.bing.com
• payload.exe

Embedded IP addresses

• 192.168.1.100
• 193.23.244.244
• 171.25.193.9
• 195.154.63.22
• 185.213.154.131
• 188.68.36.239
• 185.100.87.206
• 89.185.46.13
• 194.9.82.109
• 82.221.131.70
• 62.78.128.215
• 107.182.226.147
• 192.99.222.72
• 185.220.101.46
• 106.185.31.158
• 103.236.201.110
• 121.189.145.34
• 103.251.167.25
• 177.54.145.82
• 181.229.255.140
• 154.127.52.170
• 185.220.101.143
• 91.219.236.218
• 82.146.57.112
• 89.185.46.24

Registry keys

• HKLM\Software\Microsoft\...
• HKCU\Software\Microsoft\Terminal
• HKLM\SAM
• HKLM\SECURITY
• HKLM\SYSTEM\CurrentControlSet\Services\EventLog
• HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-Application
• HKLM\Software\Policies\Microsoft\Windows

File paths

• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\accum.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\iterator.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\ub_checks.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\ptr\const_ptr.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\vec\partial_eq.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\slice.rs
• C:\Windows\System32\winevt\Logs\
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\collections\btree\navigate.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\collections\btree\map.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\str.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\slice\iter.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\slice\mod.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\collections\btree\map\entry.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\char\methods.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\str\mod.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\str\pattern.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\slice\memchr.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\sync\atomic.rsH_
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\raw_vec.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\adapters\enumerate.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\exact_size.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\num\mod.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\ops\bit.rs
• C:\Users\Administrator\.rustup\toolchains\nightly-2024-12-01-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\sync\atomic.rs

More PowerShell samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report