MALICIOUS — virussign.com_5535247cc77df01ccc622995dfc871e0.vir

MALICIOUS — virussign.com_5535247cc77df01ccc622995dfc871e0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the HUILoader family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: baeb48dabaf645dd49f7c743653f8dcc64b16761ea944121a3d4e446d200b5eb
SHA-1: b0bfd48e55a50f97374fce79a46f99c613ce8cc6
MD5: 5535247cc77df01ccc622995dfc871e0
imphash: 04f05d51e6dcd6f4ada8f7338039b84b
ssdeep: 24576:JmbEoz4xR2vpZcU3MH1RzVuE6O+ahZChq4ZaOGyJ:JmbEJR2s//qhDZas
TLSH: T1BD566CA10366A205F6E1EF68959DCFAD18A3B85D207B1FD982C2C09D51D683F90335CB
Submitted as: virussign.com_5535247cc77df01ccc622995dfc871e0.vir
File type: pe · Size: 1466368 bytes
Verdict: malicious (96/100) · Family: HUILoader

Source: VirusSign · first seen 2026-08-17T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

capa (capabilities): capability:collection/keylog
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Phonzy.B!ml
Trellix Stinger (McAfee): Trojan-JAJC!5535247CC77D
Kaspersky (KVRT): Trojan.Win32.Agent.xbzygd

MITRE ATT&CK

Why this verdict

The malicious score of 96/100 is the fusion of 10 weighted signals:

1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 29 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2043 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787644140&P2=404&P3=2&P4=iTBYIWdYi914wOCwJDpulQI6I736ZNlkSfRE7CXI4pGJ2izpMOYvDJXG2nuTJ1rUlmSXsahk1MEnA0fYg7RR2g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.eyuyan.com

Embedded IP addresses

52.110.12.24
52.110.12.15
135.233.95.80
52.178.17.3
57.155.101.212
4.230.171.124
20.42.179.192
4.144.132.223
74.179.77.204
135.232.92.97
4.150.223.100
52.123.129.14
203.26.79.13
4.207.44.73
74.178.232.29
172.66.2.5
135.234.160.244
52.123.252.248
52.148.114.188
85.210.196.11
20.112.250.133
52.110.12.44
52.123.252.223
52.110.12.25
92.223.78.30

File paths

C:\Users\
C:\Windows
C:\1212.zip
C:\jiep.bmp
C:\jiep.jpg

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report