MALICIOUS — virussign.com_fa46b15c22c1d54766acef61f2a09340.vir

MALICIOUS — virussign.com_fa46b15c22c1d54766acef61f2a09340.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Eclz family. 5 of 53 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: c78a3a085b296c9a53d70766f6a3cc40ff55319c580773bfc5b9a4573eac8248
SHA-1: 475ad19432d0b9262aa918d66bf425920b867379
MD5: fa46b15c22c1d54766acef61f2a09340
imphash: 3553ce121ab1388c797065480a3acf50
ssdeep: 6144:zXC4vgmhbIxs3NBB38H2kYv4EzEpm0x5yGpPZPAUSNfB0VVJ9wK3mClOQ:zXCNi9Bo2FwmC5CUSj0VVJlflZ
TLSH: T1AA4612331684368DE4A30A92E07D4F0F14B650A5BAB6074DDB57E69CE1D88A70F363C6
Submitted as: virussign.com_fa46b15c22c1d54766acef61f2a09340.vir
File type: pe · Size: 314052 bytes
Verdict: malicious (100/100) · Family: Eclz

Source: VirusSign · first seen 2026-07-22T00:00:00.000Z · SHA-256 verified

Detections (5 of 53 engines)

ClamAV (daily): Win.Malware.Eclz-9953021-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Worm:Win32/Sfone!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.Murphy.3
Kaspersky (KVRT): Worm.Win32.Agent.cp

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Eclz-9953021-0 (rule Win.Malware.Eclz-9953021-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7956) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Worm:Win32/Sfone!pz (rule Worm:Win32/Sfone!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Murphy.3 (rule Gen:Heur.Mint.Murphy.3) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

73309 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded domains

112.24.180.159.in-addr.arpa
180.130.70.219.in-addr.arpa
241.125.195.236.in-addr.arpa
150.180.61.228.in-addr.arpa
114.231.42.27.in-addr.arpa
174.105.198.192.in-addr.arpa
38.179.198.238.in-addr.arpa
162.139.190.229.in-addr.arpa
153.3.48.6.in-addr.arpa
130.59.186.89.in-addr.arpa
191.237.195.227.in-addr.arpa
199.121.253.59.in-addr.arpa
160.146.164.213.in-addr.arpa
77.7.219.100.in-addr.arpa
194.188.18.161.in-addr.arpa
searchapp.bundleassets.example
www.msftconnecttest.com
www.bing.com
config.edge.skype.com
settings-win.data.microsoft.com
dns.msftncsi.com
edge.microsoft.com
aps.prod.windows.com
watson.events.data.microsoft.com
ecs.office.com

File paths

C:\password.txt
C:\debug.txt

More Eclz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report