SUSPICIOUS — virussign.com_e9799502dfb7dcf9d1aa7b2eb3285950.vir
SUSPICIOUS — virussign.com_e9799502dfb7dcf9d1aa7b2eb3285950.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (49/100), attributed to the HUILoader family. 6 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
f6728cb088c5976a520409835771c87ac39a11b58c8339cba04dfbfabe459530 - SHA-1:
04b5007d7329f6acec1a8a60e2877671d9d2cd41 - MD5:
e9799502dfb7dcf9d1aa7b2eb3285950 - imphash:
f7d9aa1586a9bf8d3a6f315b71206fa9 - ssdeep:
12288:/QOo0Fm0njgYVROCMBCrs9KuVe+WHFd9DLgy7cio8heC:/ZgYVROmae+WHFd9DLgy5eC - TLSH:
T1084F39441507B3ABEBF7B6111830579CE64772BA667C2B9C5B06E02E404F927CBD248E - Submitted as: virussign.com_e9799502dfb7dcf9d1aa7b2eb3285950.vir
- File type: pe · Size: 688661 bytes
- Verdict: suspicious (49/100) · Family: HUILoader
Source: VirusSign · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified
Detections (6 of 51 engines)
- capa (capabilities): capability:collection/keylog
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Ransom:Win64/Azov.psyA!MTB
- Emsisoft (Emergency Kit): Trojan.Ransom.Azov.1
- Trellix Stinger (McAfee): Trojan-FXIH!E9799502DFB7
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Why this verdict
The suspicious score of 49/100 is the fusion of 2 weighted signals:
- capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
Embedded domains
- ug.mi.oc.co
- schemas.microsoft.com
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report