MALICIOUS — virussign.com_c385f440ee5e0e7471065ad9dffb7c90.vir
MALICIOUS — virussign.com_c385f440ee5e0e7471065ad9dffb7c90.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Cymt family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
d840637d4deab2730f36ab665723ecf4a913aa9d7df69a3bbae1ea3cfd5f8f12 - SHA-1:
4fbb9196eab48a345af81d6e2fe78bcad6754929 - MD5:
c385f440ee5e0e7471065ad9dffb7c90 - imphash:
ebc6265200d8989371b723b2f52c43df - ssdeep:
3072:2J0Bs3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC/d/FnncroP9:awDeM7iNEkgiOb31k1ECpJ/F - TLSH:
T1D0445B8D21483AA6F2A54C28FC0909FD421FA8DA71F5BF642977C01F76BE52BB301124 - Submitted as: virussign.com_c385f440ee5e0e7471065ad9dffb7c90.vir
- File type: pe · Size: 241664 bytes
- Verdict: malicious (96/100) · Family: Cymt
Source: VirusSign · first seen 2026-08-18T00:00:00.000Z · SHA-256 verified
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Malware.Cymt-10023133-0
- YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
- Microsoft Defender: TrojanDownloader:Win32/Nemucod
- Emsisoft (Emergency Kit): Trojan.Agent.CYZT
- Kaspersky (KVRT): HEUR:Flooder.Win32.CoreWarrior.a
MITRE ATT&CK
Why this verdict
The malicious score of 96/100 is the fusion of 7 weighted signals:
- ClamAV (daily) flagged Win.Malware.Cymt-10023133-0 (rule
Win.Malware.Cymt-10023133-0) - engine signal, weight 0.90, confidence 0.95 - Contacted 24 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule
STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://wecan.hasthe.technology/upload, http://curl.haxx.se/docs/http-cookies.html - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
- Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
662 behavior events · 0 ATT&CK techniques · 4 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- wecan.hasthe.technology
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\rifaien2-gIbTbIhBJlmgnp86.exe -
c628af091a0f0dcf100173ddfb2224240d3fd292919f7d2258ce277d33c6095f - C:\Users\analyst\AppData\Local\Temp\rifaien2-PD3F2veu9FtTYnL0.exe -
6c8f0cc4d07c0d19094fc30982fd9e63286103067a6d92442108c4405ba9c1af - C:\Users\analyst\AppData\Local\Temp\rifaien2-YuW5hzaUdWk1am7z.exe -
d48f64cdcfa04f4cd9382fe57d1afb1bce3e8a0ab41ae8ac9628e8d0ab8fca97 - C:\Users\analyst\AppData\Local\Temp\rifaien2-7Jdzt6MFZw2nYBvf.exe -
c802ac9fc88c6ea87c2c7afb3a20a88782c4acec1ed0c421c06c2cbf6d7543f2
Embedded URLs
- http://wecan.hasthe.technology/upload
- http://curl.haxx.se/docs/http-cookies.html
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787750325&P2=404&P3=2&P4=eaDdwZEOeiREi%2b3opGlFyJC3HjL2IRS20n6M7CUyF08wdgR4UOVvkYPjM5cdXT28g0H1MCe%2faHZCJuina2Tt8g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787750407&P2=404&P3=2&P4=kQd1%2b0LTS3P57bRnfLcvmpBxCdmeefxTVW5APlr4LAgehaodhVbLxTv5cAj7kL3z6nxlDOAXdM3Vv2xh6mJkCw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- example.com
- curl.haxx.se
- wecan.hasthe.technology
Embedded IP addresses
- 20.184.175.13
- 52.110.12.14
- 20.247.185.124
- 57.155.104.224
- 4.230.171.124
- 52.110.12.56
- 135.232.92.137
- 20.165.94.54
- 20.42.73.24
- 52.123.252.219
- 20.231.239.246
- 52.123.129.14
- 203.26.79.13
- 172.178.240.163
- 52.123.252.245
- 135.232.92.34
- 142.251.42.99
- 40.74.98.198
- 20.42.65.84
- 104.21.59.199
- 52.148.114.188
- 72.153.5.133
- 52.110.12.2
- 52.110.12.30
More Cymt samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report