MALICIOUS — virussign.com_f7bcfe15d404d4c0851ca2e8944b95d0.vir
MALICIOUS — virussign.com_f7bcfe15d404d4c0851ca2e8944b95d0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Wingo family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
c14648c2a34771a7e64bc22cb1406efced9e04bb5fa02ff7d0b236b38353a42d - SHA-1:
d78f9cd16242ecc91ae54f60de59359e603c2089 - MD5:
f7bcfe15d404d4c0851ca2e8944b95d0 - imphash:
f0ea7b7844bbc5bfa9bb32efdcea957c - ssdeep:
49152:00MDpF0egrb/TxvO90d7HjmAFd4A64nsfJCew2r5gCYPCBgwiz1xu6d:vean1Dd - TLSH:
T1BB5A6BB806133521C1F59994F831C4DDD847B84AA2B4298D138BED7A12E7FBBE9F0056 - Submitted as: virussign.com_f7bcfe15d404d4c0851ca2e8944b95d0.vir
- File type: pe · Size: 2007633 bytes
- Verdict: malicious (99/100) · Family: Wingo
Source: VirusSign · first seen 2026-07-24T00:00:00.000Z · SHA-256 verified
Detections (5 of 53 engines)
- ClamAV (daily): Win.Malware.Wingo-10059252-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win64/Tedy!MTB
- Emsisoft (Emergency Kit): Trojan.GenericKDZ.115772
- Kaspersky (KVRT): HEUR:Trojan.Win64.Convagent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Malware.Wingo-10059252-0 (rule
Win.Malware.Wingo-10059252-0) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7540) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:Win64/Tedy!MTB (rule
Trojan:Win64/Tedy!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.115772 (rule
Trojan.GenericKDZ.115772) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
481 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- searchapp.bundleassets.example
- www.msftconnecttest.com
- staging.to-do.officeppe.com
- www.bing.com
- desktop-hsgcbep
- aps.prod.windows.com
- tas02.sls.update.microsoft.com
- config.edge.skype.com
- dns.msftncsi.com
- to-do.microsoft.com
- settings-win.data.microsoft.com
- ctldl.windowsupdate.com
- staging.to-do.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- teams.microsoft.com
- 192.168.122.107
- 192.168.122.1
- 224.0.0.252
- 192.168.122.255
Dropped files
- /opt/CAPEv2/storage/analyses/3075/files/e4ac083ca76fb241a9328c018bf070f37ae4e0449e522d2f49f277e7747f7017 -
e4ac083ca76fb241a9328c018bf070f37ae4e0449e522d2f49f277e7747f7017
Embedded domains
- runtime.name
- runtime.name.name
- reflectlite.name.name
- unicode.to
- reflect.name.name
- eq.io
- staging.to-do.officeppe.com
- searchapp.bundleassets.example
- www.msftconnecttest.com
- www.bing.com
- aps.prod.windows.com
- tas02.sls.update.microsoft.com
- config.edge.skype.com
- dns.msftncsi.com
- to-do.microsoft.com
- settings-win.data.microsoft.com
- ctldl.windowsupdate.com
- staging.to-do.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- teams.microsoft.com
More Wingo samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report