MALICIOUS — virussign.com_84c0fa4e761e232073c5e0530fbb9e20.vir

MALICIOUS — virussign.com_84c0fa4e761e232073c5e0530fbb9e20.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Reactor family. 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: b43ea58ba771c5173588ac582486bc7b5240c02140e0952b877cb95f389039c0
SHA-1: ea9eaf33c3649b552d9b5fd2117c8bbc1945060b
MD5: 84c0fa4e761e232073c5e0530fbb9e20
imphash: 88016fcdef7f227c62171d0afad9aae4
ssdeep: 98304:v5OqMtrURINHAa2JiCdJ9YKzoFOqQtAwKLoa2rCcW2A44D5kmz:B/M1URXNYKzogqQtAwKLD22V2r4jz
TLSH: T12164F18A7F1B6513C629D3101160AB7EC4E3AC4F037F5A6402A5B79E92F4E1715A03BB
Submitted as: virussign.com_84c0fa4e761e232073c5e0530fbb9e20.vir
File type: pe · Size: 5475824 bytes
Verdict: malicious (96/100) · Family: Reactor

Source: VirusSign · first seen 2026-07-25T00:00:00.000Z · SHA-256 verified

Detections (4 of 53 engines)

capa (capabilities): beacon to command-and-control
MalwareAnalyser heuristics (entropy/packer): .NET Reactor 2.X-3.X
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:.NET Reactor 2.X-3.X

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 10 weighted signals:

Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7460) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
beacon to command-and-control (rule beacon to command-and-control) - capa signal, weight 0.45, confidence 0.80
Contacted 33 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
Contacted 33 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:.NET Reactor 2.X-3.X (rule DIE:.NET Reactor 2.X-3.X) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://jrsoftware.org/ishelp/index.php?topic=setupcmdline, 2.0.40.78 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: .NET Reactor 2.X-3.X - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

6138 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3104/files/dcbab07aa57abc62b3c90ba58cbaa0bfb77d0bbed023203f4f00702a69eba9ec - dcbab07aa57abc62b3c90ba58cbaa0bfb77d0bbed023203f4f00702a69eba9ec
772a1ce1f34dc2323d40c54fb9d4959945933b0f04b8c3bbbd5ffe8c56fa9641 - 772a1ce1f34dc2323d40c54fb9d4959945933b0f04b8c3bbbd5ffe8c56fa9641
2b534884c1073b07acb26a8d86735309484b55b3fc00f7e77e0b562bcb9a8c0b - 2b534884c1073b07acb26a8d86735309484b55b3fc00f7e77e0b562bcb9a8c0b

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
https://sectigo.com/CPS0
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
https://jrsoftware.org/ishelp/index.php?topic=setupcmdline
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/92621512-d997-4742-9ae0-db0593ed93c6/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/92621512-d997-4742-9ae0-db0593ed93c6?P1=1785799467&P2=404&P3=2&P4=EfLdvh0Xi5FS4Lhh9FziEZGaD4e3FMkTQidUT4tj9hJMZyy4QFNmx0I0qqOBD1UhJPxwIZRwb8ueAbJtKRPkhw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/2b0b8d49-f247-4474-b072-f23db6087184/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/2b0b8d49-f247-4474-b072-f23db6087184?P1=1785799499&P2=404&P3=2&P4=TKMbfnj1bw6%2bO%2bd7Yma70i5q4bnbEWlZzyFXy4%2bc0qTrfCFMgEI0EVmcJK4PhkgyZRz%2ftj8Ed9W0jsqKQ0adEw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
crl.comodoca.com
cacerts.digicert.com
crl3.digicert.com
crl.sectigo.com
crt.sectigo.com
sectigo.com
jrsoftware.org
oneclient.sfx.ms
searchapp.bundleassets.example
www.msftconnecttest.com
config.edge.skype.com
www.bing.com
dns.msftncsi.com
officeclient.microsoft.com
v10.events.data.microsoft.com
ctldl.windowsupdate.com
ocsp.digicert.com
oneocsp.microsoft.com
odc.officeapps.live.com
v20.events.data.microsoft.com
aps.prod.windows.com
watson.events.data.microsoft.com
msedge.api.cdp.microsoft.com
geo.prod.do.dsp.mp.microsoft.com

Embedded IP addresses

2.0.40.78
52.123.252.224
23.33.238.115
23.40.52.85
52.123.252.213
4.150.223.110
20.42.73.30
172.178.240.162
199.232.138.172
52.123.252.243
74.179.71.159
203.26.79.13
52.123.252.202
74.179.77.204
74.178.76.54
4.150.223.114
150.171.27.11
150.171.109.25
23.11.37.157
204.79.197.203
151.101.30.172
20.190.167.66
52.230.59.222
23.221.133.185
23.221.133.123

File paths

T:\:d:l:p:t:x:
X:\:`:d:h:l:p:t:x:
N:\:k:
E:\:
X:\:`:h:p:x:
U:\:c:j:t:
T:\:j:x:
X:\:d:h:p:t:x:
T:\:d:l:t:
D:\Coding\Is\issrc-build\Components\ChaCha20.pas
x:\dirname

More Reactor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report