MALICIOUS — virussign.com_5323231bc4d2891f3cc621824a60c5b0.vir

MALICIOUS — virussign.com_5323231bc4d2891f3cc621824a60c5b0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: dbb7c5e117c4742228b758abff1a13f3e253384351ecaa10c2edfcc015e8ac3d
SHA-1: 2bc777d6e4dde4486e0bf919acb363f12e88567a
MD5: 5323231bc4d2891f3cc621824a60c5b0
imphash: 7c9c55b28dfdff534d6d018346b846d1
ssdeep: 768:GcUp7BmsJ/LlxWFhWwhE+sonq9urf2/s0bK0Re0r/f03mIPmB5Z6qH2p/1H5pXd7:G7p7MGwhaQrfH0baS0ROBiqH2LVOG
TLSH: T149355A26A9056B21FCF4A1CFC61DB97E09915E33E2FA5701F9BA31A0154FAC7230648D
Submitted as: virussign.com_5323231bc4d2891f3cc621824a60c5b0.vir
File type: pe · Size: 60458 bytes
Verdict: malicious (99/100) · Family: Crypted

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-29
Microsoft Defender: Trojan:Win32/Cerber!pz
Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.9A660621
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vih

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-29 (rule Win.Trojan.Crypted-29) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Cerber!pz (rule Trojan:Win32/Cerber!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Dacic.1.Backdoor.Hangup.A.9A660621 (rule GenPack:Generic.Dacic.1.Backdoor.Hangup.A.9A660621) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vih (rule Trojan-Proxy.Win32.Qukart.vih) - engine signal, weight 0.55, confidence 0.85
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

360 behavior events · 1 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Windows\System32\Kacocm32.exe - 60469369a43d5bf6fba66c43ff1ded81f0e10dd01af120aafb902df12d1d94a6
C:\Windows\System32\Ibnilc32.exe - 3a679705af38c6b4ffd02900c0ea54856532c752fa5ecb5958190b40ad26e3fc
C:\Windows\System32\Jfjjhccn.dll - bfae84d63b5614edd313501df0bc9997af210e9b2181c1b77f39db4f27989f50
C:\Windows\System32\Bkbjkm32.dll - 7346c2885512295e52761e53bec5824efcb680e6184f03dd51a9087f020c6ada
C:\Windows\System32\Mkeoiodf.exe - 52b194adc9a827456e862b57e57c8788935a644ef310931bd5382dcd77122b10
C:\Windows\System32\Ahdgbjeg.dll - 9f225079875d7d5c3e3cba164d2116895f34f85731ad64c7c48a87be67eb163f
C:\Windows\System32\Ibfckd32.exe - a0b17bf6300d657421d0b06754d9bf66bbbb484ed9884fec8518ea11e7166fe3
C:\Windows\System32\Kmjbobdb.dll - b309175b541e3d9692d73a5da9ee28faca8530ff64ca42ab82089e307e339c4c
C:\Windows\System32\Gcgflo32.exe - 6c62070f2881eb1cbd8baaee29ebc2b8ae357b7304bd576d2e2c0baf72ba6aff
C:\Windows\System32\Mbcpkajg.dll - 5b8e4a08467aaad330fbf4da4dd64746324dfc0fb6d04ad51a7ac2c6bf44b0ff

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

aefd.nelreports.net

Embedded IP addresses

51.105.71.136
20.247.185.124
52.123.252.238
4.230.171.124
172.64.154.167
74.178.240.51
4.247.188.233
4.150.223.114
20.165.94.63
4.150.223.98
135.234.160.245
52.110.12.28
52.110.12.14

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report