MALICIOUS — virussign.com_83c61068e9863c010a9e2c0adf826ef0.vir

MALICIOUS — virussign.com_83c61068e9863c010a9e2c0adf826ef0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Cuegoe family. 4 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: bb752ccfa6c325742bb6aece7257c04344243a9325eabd909091e5bd05a15913
SHA-1: e4bece09d56e13004a3e094d22eb1a2bbca0b662
MD5: 83c61068e9863c010a9e2c0adf826ef0
imphash: 6dca3e9fb3928bbdb54dbce669943ec8
ssdeep: 12288:wU5rCOTeiDk/P5FOBXP0jfxhP+ONZ+3/v+I9hUG2VA:wUQOJDssMeONGEA
TLSH: T1D54ED1CE5140F341D973AF6225546DCE60B278C2A8753E8C0B83F03B17B5D27B86A5A9
Submitted as: virussign.com_83c61068e9863c010a9e2c0adf826ef0.vir
File type: pe · Size: 667648 bytes
Verdict: malicious (100/100) · Family: Cuegoe

Source: VirusSign · first seen 2026-07-22T00:00:00.000Z · SHA-256 verified

Detections (4 of 53 engines)

ClamAV (daily): Win.Trojan.Cuegoe-6336261-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: TrojanDownloader:Win32/Upatre
Kaspersky (KVRT): HEUR:Backdoor.Win32.Salgorea.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Cuegoe-6336261-0 (rule Win.Trojan.Cuegoe-6336261-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7988) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged TrojanDownloader:Win32/Upatre (rule TrojanDownloader:Win32/Upatre) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 31 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Contacted 31 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2583 behavior events · 2 ATT&CK techniques · 29 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/2968/files/9b3b273094dbd4ac8819f347dbe721289b2132fd2d5251b8747cf883603bd922 - 9b3b273094dbd4ac8819f347dbe721289b2132fd2d5251b8747cf883603bd922
/opt/CAPEv2/storage/analyses/2968/files/b8efe47633732145c1c9b41f85dc820d178d9a5540a8ea413336928bbf6d905e - b8efe47633732145c1c9b41f85dc820d178d9a5540a8ea413336928bbf6d905e
/opt/CAPEv2/storage/analyses/2968/files/d430bb586998d3928d2bc78daa80c50f412faeee7632a6892b14b5eb4cc7fc00 - d430bb586998d3928d2bc78daa80c50f412faeee7632a6892b14b5eb4cc7fc00
/opt/CAPEv2/storage/analyses/2968/files/e4a3e3330f3f04a23f0aac672edb3f5f2323942da3305b92f1e00525ff230384 - e4a3e3330f3f04a23f0aac672edb3f5f2323942da3305b92f1e00525ff230384
/opt/CAPEv2/storage/analyses/2968/files/5cb3ed4f2e18343ce14bc8db65b4aa81d30737c63f340e2a961d5efaca97a189 - 5cb3ed4f2e18343ce14bc8db65b4aa81d30737c63f340e2a961d5efaca97a189
/opt/CAPEv2/storage/analyses/2968/files/a9296c4bec4b9dd4b99b530f3c3323b4b3b4e54ff7293925e21ac8ac21daa65c - a9296c4bec4b9dd4b99b530f3c3323b4b3b4e54ff7293925e21ac8ac21daa65c
/opt/CAPEv2/storage/analyses/2968/files/524754c9c3ab88ac2707d5dbc9c1324eb08612b970e3c6ce0c08806b21b3f700 - 524754c9c3ab88ac2707d5dbc9c1324eb08612b970e3c6ce0c08806b21b3f700
/opt/CAPEv2/storage/analyses/2968/files/9d0b88d33f1bc3134e0aed43d0047c8bf255df69f4539b1debc256ec9ce9f39b - 9d0b88d33f1bc3134e0aed43d0047c8bf255df69f4539b1debc256ec9ce9f39b
/opt/CAPEv2/storage/analyses/2968/files/87e9fd13a76d4fc50f82869687c3d5e4eb451f3a9e25b770a1580bcc6bda1538 - 87e9fd13a76d4fc50f82869687c3d5e4eb451f3a9e25b770a1580bcc6bda1538
/opt/CAPEv2/storage/analyses/2968/files/98dad912845ed7114df2e549773826c5ad693b0146017ae9a0d6ab76edc85fb2 - 98dad912845ed7114df2e549773826c5ad693b0146017ae9a0d6ab76edc85fb2
/opt/CAPEv2/storage/analyses/2968/files/9630ebb7852b9a0cd57b2020aed69b11d6b8882443e1cd60d949e4937000af89 - 9630ebb7852b9a0cd57b2020aed69b11d6b8882443e1cd60d949e4937000af89
/opt/CAPEv2/storage/analyses/2968/files/e0963a049caccf8a1ad70d5cfb026095f65b0b2cca6899d9533a3891c0fc0ca2 - e0963a049caccf8a1ad70d5cfb026095f65b0b2cca6899d9533a3891c0fc0ca2
/opt/CAPEv2/storage/analyses/2968/files/cba1e3aecca0b3d279745146feaad69b3811c7e903fd2c288afbf237fd75827e - cba1e3aecca0b3d279745146feaad69b3811c7e903fd2c288afbf237fd75827e
/opt/CAPEv2/storage/analyses/2968/files/a553d4d172afa635f0c8a94102d9a2e5872313148c9d6897de006fee59aeebd2 - a553d4d172afa635f0c8a94102d9a2e5872313148c9d6897de006fee59aeebd2
/opt/CAPEv2/storage/analyses/2968/files/d5eadffaaa009da0a2bf1646cc52e117353bf0918c21233b1f94a22682fc5b5d - d5eadffaaa009da0a2bf1646cc52e117353bf0918c21233b1f94a22682fc5b5d

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/ado/2007/08/dataservices/metadata
http://schemas.microsoft.com/ado/2007/06/edmx
http://schemas.microsoft.com/ado/2006/04/edm
http://schemas.microsoft.com/ado/2007/05/edm
http://schemas.microsoft.com/ado/2008/01/edm
http://www.w3.org/2001/XMLSchema-instance
http://schemas.microsoft.com/ado/2008/01/edm:OpenType
http://schemas.microsoft.com/ado/2008/09/edm
http://schemas.microsoft.com/ado/2006/04/edm/ssdl
http://schemas.microsoft.com/ado/2009/02/edm/annotation
http://schemas.microsoft.com/ado/2007/08/dataservices/scheme
http://www.w3.org/2005/Atom
http://www.w3.org/2000/xmlns/
http://schemas.microsoft.com/ado/2006/04/edm/ssdl:StoreGeneratedPattern
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/92621512-d997-4742-9ae0-db0593ed93c6/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/92621512-d997-4742-9ae0-db0593ed93c6?P1=1785782687&P2=404&P3=2&P4=IAVLHdIH2%2fdCvtiYGKgVFDw16IcYV8r4aCyXHAnKihoP5n1dtO0qRUiCWkEtavGAqWeJTRSuWLcgzs1BoSHabg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
www.w3.org
oneclient.sfx.ms
searchapp.bundleassets.example
www.msftconnecttest.com
www.bing.com
dns.msftncsi.com
config.edge.skype.com
officeclient.microsoft.com
v10.events.data.microsoft.com
ctldl.windowsupdate.com
ocsp.digicert.com
oneocsp.microsoft.com
odc.officeapps.live.com
v20.events.data.microsoft.com
aps.prod.windows.com
tas02.sls.update.microsoft.com
fe3cr.delivery.mp.microsoft.com
watson.events.data.microsoft.com
slscr.update.microsoft.com
msedge.api.cdp.microsoft.com
geo.prod.do.dsp.mp.microsoft.com
kv801.prod.do.dsp.mp.microsoft.com
cp801.prod.do.dsp.mp.microsoft.com
msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

23.33.238.102
150.171.22.17
23.40.52.209
4.150.223.96
52.168.117.174
23.33.238.114
74.179.77.204
74.178.240.51
20.42.65.85
172.178.240.163
199.232.138.172
13.69.116.108
203.26.79.13
150.171.28.11
150.171.109.24
151.101.30.172
23.11.37.157
204.79.197.203
2.18.226.39
2.18.225.206
72.145.35.110
150.171.109.17
74.179.71.159
52.123.252.193
104.208.16.94

File paths

D:\:p:
f:\dd\tools\devdiv\EcmaPublicKey.snk
U:\:c:j:q:x:
P:\:d:

More Cuegoe samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report