MALICIOUS — virussign.com_e8cba882720348eab1fc1fe59fdaf990.vir

MALICIOUS — virussign.com_e8cba882720348eab1fc1fe59fdaf990.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Autorun family. 7 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: ca242dbeb1ec2cf02cff48ba8b2678d037023a0bd6e09a3654bb3e0611ca78f3
SHA-1: 7f34ec9f99c00d4bc99f9ca8c9a2e74d509de270
MD5: e8cba882720348eab1fc1fe59fdaf990
imphash: 178689c38c1294cbf87aafcafb2357ed
ssdeep: 24576:XJujSgOZL7nY/F8mPl8JFFZW01WwZ7kYybmcU+e3c51Zgkp:ZujM3nY2Eul801WwdkYy7U+e3c53gS
TLSH: T1C75633D3934BECCDDF8D7DB6206869CDFA9835B053240BA94663186D80D230BBB4255E
Submitted as: virussign.com_e8cba882720348eab1fc1fe59fdaf990.vir
File type: pe · Size: 1441547 bytes
Verdict: malicious (100/100) · Family: Autorun

Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified

Detections (7 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Genpack-10015161-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Worm:Win32/Autorun
Emsisoft (Emergency Kit): Trojan.Stealer.556
Kaspersky (KVRT): HEUR:Backdoor.Win32.IRCBot.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Genpack-10015161-0 (rule Win.Malware.Genpack-10015161-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 24 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

10056 behavior events · 3 ATT&CK techniques · 27 dropped files.

Dropped files

C:\Windows\System32\Drivers\spools.exe - 4a5e0dc98a83a97f7479fbecae98b92a44878bea8a2801f4cfaa625343ac29dc
C:\Windows\System32\Drivers\spools.exe - 7d4cebb527d5ff6fac33bcdbeea492988207014f62ddffc1fc72aff9dd3fcfb4
C:\Windows\System32\Drivers\spools.exe - 20deb5fa8cbc361c52ea4ac1c4b99a335d4cc35466a1a3690286709e617c321a
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - 1051f33ebfb6af129930c6f5484d4804471edea1bf0f266cf6703b1578d6e93c
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - 11cc52ed545ead38a994657832cd9a30f6edd516fbd9b5cb0b80cda1c536a967
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - 9c49b9aa84f552974e3a7cee016e225bad32d7cb6fc10beef558c190320775e3
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - e25ea31caea80e13361ac0ee6bda15d655bf2b5676ecec23ef4c920caef1b3d9
C:\stop - 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
C:\Windows\System32\Drivers\spools.exe - cbd1be9f6f8b5238c0faef9bb16accc8bc5c298f876799e9cf0b89ed8513a708
C:\Windows\System32\Drivers\spools.exe - d9d20ef1fd53b0e8db5d482099027826d853ded37697a4d328b6de85ed168589
C:\Windows\System32\Drivers\spools.exe - 2d6008e2b7157007cf120d04df78e759d060894c951fcda72cd7fe7c53737c51
C:\Windows\System32\Drivers\spools.exe - aff25b42c974f25fd90680bb262967fa1e4d6873eec1af5bee6ad6d58eb26c57
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - 8b1e0c411380c1cde5ec53caf8ec82d180fe7290c1984d0130efd5c2c5359590
C:\Users\analyst\Local Settings\Application Data\cftmon.exe - 9837dc51205bd0719e5c217be6a8a72fdb73e5e4c5eae1b3943ab745a17442b0
C:\Windows\System32\Drivers\spools.exe - 4758995c6729992f4b9aed84781724960b8357c002fb4d1d68f2692e0adddfa2

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787937085&P2=404&P3=2&P4=ClkEpIYPw%2frWxRwlKUvxKryEzs9L5zax1cYX2fbCGjOS3KU3IfEmQZEhT4hodkkCxrdhzaPtAFqsqdb150y12Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

j.it
a.mx
bublikiadministrator.com

Embedded IP addresses

203.26.79.13
40.79.163.155
52.123.252.240
20.247.184.197
20.42.179.192
4.230.171.124
135.232.92.137
4.150.223.96
74.178.76.54
20.236.44.162
52.123.128.14
40.99.134.18
40.99.133.226
52.123.129.14
52.123.252.243
193.166.255.171
92.223.78.30
135.233.45.223
52.148.114.188
52.123.252.198
162.159.142.9
74.179.71.159
72.154.7.105
57.155.101.212
20.184.175.8

More Autorun samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report