MALICIOUS — virussign.com_cfcf48d6a2f4192df1915308187b0e80.vir

MALICIOUS — virussign.com_cfcf48d6a2f4192df1915308187b0e80.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (79/100), attributed to the Berbew family. 2 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: f7f846d40a68f58f33105b456bf1cd69e244645809e8cb166e6f2d2de442b853
SHA-1: 09e4575a0dd191897986e6707d71c10c518aaf53
MD5: cfcf48d6a2f4192df1915308187b0e80
imphash: 731b7e280add7ddd2d8bee2511c30cf5
ssdeep: 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWpbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPvq3qX5S2hV
TLSH: T1B21F54426137497CDAEBD180FD13AB5CA5A2F893F5197448C84A1013C2CB97B4199DFE
Submitted as: virussign.com_cfcf48d6a2f4192df1915308187b0e80.vir
File type: pe · Size: 7169 bytes
Verdict: malicious (79/100) · Family: Berbew

Source: VirusSign · first seen 2026-07-19T00:00:00.000Z · SHA-256 verified

Detections (2 of 52 engines)

Microsoft Defender: Backdoor:Win32/Berbew.AA.dll
Kaspersky (KVRT): Backdoor.Win32.Padodor.ab

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 79/100 is the fusion of 4 weighted signals:

Memory forensics: 5 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8184) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Backdoor:Win32/Berbew.AA.dll (rule Backdoor:Win32/Berbew.AA.dll) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

102 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded domains

staging.to-do.officeppe.com

More Berbew samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report