MALICIOUS — virussign.com_9458d56d48dc121616cd3700b8590100.vir
MALICIOUS — virussign.com_9458d56d48dc121616cd3700b8590100.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AsyncRAT family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
dfacf5ce39bd2efe8901d6654a8f70ce0a646a5b851de25f70121c23db68b3c6 - SHA-1:
26035c85e5466181f074e1261bfe019c7c3be251 - MD5:
9458d56d48dc121616cd3700b8590100 - imphash:
5e8d4f8cd8338a3004bd8bf0ec8c38c8 - ssdeep:
196608:uFKcF3d1EdvMmdolW1uDZDtawLKAEmuR:ZcN16NoquDNn2mu - TLSH:
T147696CA182172122E5F98C50F43AC4DCA84BFA99A1711FCC9207D97641DD73FE3E60A6 - Submitted as: virussign.com_9458d56d48dc121616cd3700b8590100.vir
- File type: pe · Size: 8183089 bytes
- Verdict: malicious (100/100) · Family: AsyncRAT
Source: VirusSign · first seen 2026-08-21T00:00:00.000Z · SHA-256 verified
Detections (6 of 55 engines)
- ClamAV (daily): Win.Coinminer.Generic-7158858-0
- YARA: Intezer community: INTEZER_Linux_XMRig_Miner
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Trojan:Win64/DisguisedXMRigMiner
- Kaspersky (KVRT): Trojan.Win64.Miner.lwki
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 12 weighted signals:
- ClamAV (daily) flagged Win.Coinminer.Generic-7158858-0 (rule
Win.Coinminer.Generic-7158858-0) - engine signal, weight 0.90, confidence 0.95 - Extracted AsyncRAT config (1 C2) - engine signal, weight 0.80, confidence 0.65
- Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 28 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- YARA: Intezer community flagged INTEZER_Linux_XMRig_Miner (rule
INTEZER_Linux_XMRig_Miner) - engine signal, weight 0.35, confidence 0.70 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://www.dropbox.com/s/bq2m1ynjn8vxlur/AnormalesWizard.zip?dl=0https://www.dropbox.com/sh/kidub9saizdl7ra/AADQvWkyXtg9g96L5a5TxZ3Ua/?dl=0malformed, https://www.dropbox.com/sh/mjkdpouf1v59ocz/AACdZQ46UQm79uNblpkDoTtAa?dl=0&m=runtime, 5.4.32.5 - static signal, weight 0.35, confidence 0.60
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
14090 behavior events · 2 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- www.maxmind.com
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
Embedded URLs
- https://www.dropbox.com/s/bq2m1ynjn8vxlur/AnormalesWizard.zip?dl=0https://www.dropbox.com/sh/kidub9saizdl7ra/AADQvWkyXtg9g96L5a5TxZ3Ua/?dl=0malformed
- https://www.dropbox.com/sh/mjkdpouf1v59ocz/AACdZQ46UQm79uNblpkDoTtAa?dl=0&m=runtime
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787937142&P2=404&P3=2&P4=hmi9ttWhWV6Yg9BdqFT4tvxOpLDyqlq3ObIr%2bRUJmDNRn5x9IbY0wXCUcROCUujA0gu7TWu6aM4yK7MqJDfaMQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787937206&P2=404&P3=2&P4=jFqzSfeyIS1MBVjyqmxhyXgC9snL4ymHfdbG1NN94gQRsd7%2foO5NaGvzQLSQ8jcxfr14%2bXb5wTyZS8JCclACHg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787937264&P2=404&P3=2&P4=hHeNaA7PsgDpokXw5mLMK%2bIsGohD9x4dlb1OdZ%2bjR0VaG6Ujs5UWP0mOiVB%2fp%2bj5B6UezUvMeLQK8cfWuM4h%2fg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- big.int
- idna.info
- pkix.name
- reflect.name
- runtime.name
- reflectlite.name
- golang.org
- s.readme.io
- harikaindustries.co.in
- codeload.github.com
- www.dropbox.com
- drive.google.com
- www.bates.edu
- www.apkmirror.com
- raw.githubusercontent.com
- atomic.store
- runtime.name.name
- reflectlite.name.name
- unicode.in
- unicode.to
- reflect.name.name
- reflect.fun
- hash.golang.org
- eq.golang.org
- rand.int
Embedded IP addresses
- 5.4.32.5
- 4.52.5.4
- 62.5.4.72
- 5.4.82.5
- 5.4.112.5
- 4.1.1.1
- 4.9.1.1
- 4.12.1.1
- 4.14.1.1
- 4.14.2.1
- 2.3.1.1
- 2.4.1.1
- 1.1.1.1
- 2.2.1.1
- 35.156.248.16
- 20.89.1.8
- 52.123.252.216
- 52.230.59.222
- 4.144.132.223
- 4.247.188.233
- 4.230.171.124
- 20.42.179.192
- 74.178.240.61
- 74.178.76.54
- 20.50.73.14
File paths
- c:\go
More AsyncRAT samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report