MALICIOUS — virussign.com_6687278cbf0fb883d2a635ecf90d72e0.vir

MALICIOUS — virussign.com_6687278cbf0fb883d2a635ecf90d72e0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Flystudio family. 7 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: b72341766b5b787afcc1faecd39913b774a8f9c7d3dcd6e596b9b1c091bc93dc
SHA-1: ff5bbf83486a23ac0caa3daf511ba2684ebd52bc
MD5: 6687278cbf0fb883d2a635ecf90d72e0
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 98304:bImZG9QR5JzQ9op9VbQzwIqIg42/HHhNGPo+fKWTCB:XZGmuesR2/LGPLCB
TLSH: T16764E0332050EF42F3D4DADC595E4A2D91779E4F25B51BC4DE92E02C32D8CA379128AA
Submitted as: virussign.com_6687278cbf0fb883d2a635ecf90d72e0.vir
File type: pe · Size: 5177344 bytes
Verdict: malicious (91/100) · Family: Flystudio

Source: VirusSign · first seen 2026-08-19T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:oiNRhy0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Detect It Easy (packer/type): DIE:VMProtect
Microsoft Defender: Trojan:Win32/Flystudio!pz

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 91/100 is the fusion of 9 weighted signals:

Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:VMProtect (rule DIE:VMProtect) - engine signal, weight 0.35, confidence 0.70
query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:oiNRhy0, VMProtect - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787783167&P2=404&P3=2&P4=fP%2fO4qzraWC7xH66qMZvOuo%2fiWlC664rQ7roA5ztvJ8RPYxgQBXFY310155b%2fJtkWWe4FqNrjUr2qcNLbt0Y4g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

mw.co
yfg.tv

Embedded IP addresses

20.184.175.5
74.178.240.61
4.144.132.114
4.230.171.124
135.233.95.135
51.116.253.168
40.84.85.40
20.89.1.12
20.76.201.171
52.123.129.14
52.123.128.14
203.26.79.13
135.232.92.34
52.148.114.188
72.153.5.61
52.110.12.20
52.110.12.31

File paths

C:\tsz
T:\:d:l:t:
w:\iG=+

More Flystudio samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report