MALICIOUS — virussign.com_e14397d97c72af1585864b3c082c8890.vir

MALICIOUS — virussign.com_e14397d97c72af1585864b3c082c8890.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Berbew family. 3 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: cd2b56b314882113792e86c3a386a1dcbe33c5064180430c5e2e2d3130310de2
SHA-1: 06207a8cd16e0e7febb416d198249a9fd92473f6
MD5: e14397d97c72af1585864b3c082c8890
imphash: 0ed11c14a2759c69bfa93dd64e1f1654
ssdeep: 48:6DOdd5YVOiFVE/y/sqwokyJyi0VB+BDq9J5S9:piFVE/y6okJhB+FqX5S9
TLSH: T1FF1D6013113345BCE26BC190F993AF0C66A2B443E169284CC90F641BD2CA93351E99FF
Submitted as: virussign.com_e14397d97c72af1585864b3c082c8890.vir
File type: pe · Size: 6145 bytes
Verdict: malicious (89/100) · Family: Berbew

Source: VirusSign · first seen 2026-07-18T00:00:00.000Z · SHA-256 verified

Detections (3 of 53 engines)

Microsoft Defender: Backdoor:Win32/Berbew
Emsisoft (Emergency Kit): Gen:Variant.Virus.Virlock.16
Kaspersky (KVRT): Backdoor.Win32.Padodor.gen

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 89/100 is the fusion of 5 weighted signals:

Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 6088) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Backdoor:Win32/Berbew (rule Backdoor:Win32/Berbew) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Virus.Virlock.16 (rule Gen:Variant.Virus.Virlock.16) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

100 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded domains

staging.to-do.officeppe.com
searchapp.bundleassets.example
www.msftconnecttest.com
www.bing.com
config.edge.skype.com
tas02.sls.update.microsoft.com
dns.msftncsi.com
settings-win.data.microsoft.com
to-do.microsoft.com
ctldl.windowsupdate.com
staging.to-do.microsoft.com
watson.events.data.microsoft.com
edge.microsoft.com
teams.microsoft.com

More Berbew samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report