MALICIOUS — virussign.com_598e92d63ef62435d235e2c89cb03380.vir
MALICIOUS — virussign.com_598e92d63ef62435d235e2c89cb03380.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the HUILoader family. 7 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
c2f1177689671ac1b8f38d3f3dcfc58ef5ea775bc9cf017cdbced12150a3e006 - SHA-1:
e30538876f25553377c07ca85f9367424d8910c6 - MD5:
598e92d63ef62435d235e2c89cb03380 - imphash:
758906d99863fb03ddd9f7fecf7e9e42 - ssdeep:
6144:NfpxXYNt45SvibADn0ofR7JxNwqdfNqWVqQfIcbXr1VJCIA6srTZbRO:NfpxCL0QJTEWVqQfISxVJCIApO - TLSH:
T12C4A4B8C9711A645EFF2C7103CD1BE0E20E2A5DBE2BD088C5397D12E66DB5BFA025419 - Submitted as: virussign.com_598e92d63ef62435d235e2c89cb03380.vir
- File type: pe · Size: 460299 bytes
- Verdict: malicious (87/100) · Family: HUILoader
Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified
Detections (7 of 55 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- capa (capabilities): capability:collection/keylog
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win32/Zusy.LRK!MTB
- Emsisoft (Emergency Kit): Gen:Variant.Midie.178894
- Trellix Stinger (McAfee): Trojan-JZAA!598E92D63EF6
- Kaspersky (KVRT): HEUR:Trojan-Ransom.Win32.Agent.gen
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 87/100 is the fusion of 5 weighted signals:
- Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 32 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Dropped 14 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
16414 behavior events · 0 ATT&CK techniques · 15 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
- licensing.mp.microsoft.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
Dropped files
- C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe -
4d23ae15765e60bbb6d3b025e4e50c78b3dae61d4f94aec979b27d8823f874b0 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe -
bcfb755c4ce2a58ccfafb85533c915d23780aeddc35dd3df8d48bb4da5bd2d85 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe -
af8c0d2b1bc20c2aca007726f230858d927c064c5354ecdf8c637a6fd769d3ea - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe -
5ffd894aa3f6e176d37d8f93f294a07b2fa5826c0c1548bc3e47caa4b64433ba - C:\Users\analyst\AppData\Local\Temp\tsk_3a9476c5935440a8.exe -
98dc2c1e340c6da6a9ff619f368e9b27b12a2853cd06b229fc0739837c538cf6 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe -
1b916461abe3c17efe3f14bc0d9a017d62c2c60e804294212c39f388b5f2c00d - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe -
c4f5707a24df4aef0f774d132ac6c38f2c87b06e0afdf3f4cbc28c2a3a8479d2 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe -
ab3b71045a3e5f03fea0c0149f4891f4392f37890b4a7bf646041fd8cf678c37 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe -
6d287d73cf95f6319fe9425d64033c5976acee50c736dca52618bdc0173b64d6 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe -
afc1b4f8dd85e5d2418211f1d885694d949b6220c56420d3c49fa8c2dc6a3068 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe -
54c1ed8ee1cbc49a84542b3f1c4eec7f331c96f7578a1fcbc9ee5b0a4a800f2c - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe -
034de1351fb76b74db6a830c174032fba68f16839c7954ec2bb761739616c00f - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe -
ac60a6850d54def24d77092a2233079c486ca3aea2271e1881699b2b527ec26e - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe -
1d952e693497d6a2acdd3d31073b66647031936d9ea583eb8b58977439a8cff6 - 5976f978abb3fe1b89692e581e7ad68f2fa84953be9ff3e5ed6d9821e218a4eb -
5976f978abb3fe1b89692e581e7ad68f2fa84953be9ff3e5ed6d9821e218a4eb
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787737347&P2=404&P3=2&P4=HsWc8SL8K3dxblqCm4IA4U5vtjEY%2fNLD6mbKecaRgZ22hRCynP0cnVFxX4L0SH%2fgEJO0UQ9%2fg9%2bXe4FWxQT5Kg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787737370&P2=404&P3=2&P4=mRQQJXz6EF3vDH2CjS2CvmqykFb9TBlh5t%2buM6wHv52zWTCj8mNT5vCiXwDlM%2fJbiwYjM27SjxunBcZlkY39oA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://c.pki.goog/r/gsr1.crl
- http://c.pki.goog/r/r4.crl
Embedded IP addresses
- 4.144.132.223
- 72.145.35.110
- 135.232.92.34
- 104.46.162.231
- 20.42.179.192
- 4.230.171.124
- 57.154.63.210
- 20.165.94.63
- 135.232.92.97
- 52.182.143.212
- 135.233.95.144
- 4.150.223.112
- 52.123.128.14
- 20.76.201.171
- 52.123.129.14
- 52.123.252.197
- 52.110.12.33
- 52.110.12.19
- 135.234.160.246
- 52.123.252.203
- 74.178.232.29
- 52.123.252.245
- 203.26.79.13
- 52.148.114.188
- 85.210.196.11
File paths
- f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp
- f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
- f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
- f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
- f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report