MALICIOUS — virussign.com_208588d6d1cfc823f90c809889826ea0.vir

MALICIOUS — virussign.com_208588d6d1cfc823f90c809889826ea0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Cymt family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: fe6b36f68b43f4959d460145cb5abf2f01368731f554ef1b700e5b259ea63985
SHA-1: 35d560c4eb0f0b4cab89e70770e3179e60ff7593
MD5: 208588d6d1cfc823f90c809889826ea0
imphash: 0610e3122d836e63ce854b2e7aa102c2
ssdeep: 3072:Ss3o8A4M3riN6MhGkgS3PL6pb9t16n5OkhBOPC///FnncrRXRPYDG:SDeM7iNEkgiOb31k1ECPJqhSG
TLSH: T16B405C9921483AA6F2E64C24FC1519FD421F68DA71F5FF642937C01F76BE92BA301124
Submitted as: virussign.com_208588d6d1cfc823f90c809889826ea0.vir
File type: pe · Size: 169000 bytes
Verdict: malicious (98/100) · Family: Cymt

Source: VirusSign · first seen 2026-07-18T00:00:00.000Z · SHA-256 verified

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Cymt-10023133-0
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
YARA: MalwareAnalyser community pack: TL_UPX_Packed
Detect It Easy (packer/type): DIE:UPX 3.94
Kaspersky (KVRT): VHO:Flooder.Win32.CoreWarrior.gen
Microsoft Defender: TrojanDownloader:Win32/Nemucod
Emsisoft (Emergency Kit): Trojan.Agent.CYZT

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 98/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Cymt-10023133-0 (rule Win.Malware.Cymt-10023133-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8044) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_UPX_Packed (rule TL_UPX_Packed) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX 3.94 (rule DIE:UPX 3.94) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://wecan.hasthe.technology/upload, http://curl.haxx.se/docs/http-cookies.html - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, UPX 3.94 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

67 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/3690/files/ede6b8106175e00fabb98b2e6f45f9c6b4f912db3d25abafac478b42b40270ce - ede6b8106175e00fabb98b2e6f45f9c6b4f912db3d25abafac478b42b40270ce
/opt/CAPEv2/storage/analyses/3690/files/16f95786d6be99efdd7dc5e0637e8d831f1e32ba5332f7de26035157693cec09 - 16f95786d6be99efdd7dc5e0637e8d831f1e32ba5332f7de26035157693cec09
/opt/CAPEv2/storage/analyses/3690/files/cead4fd08eaaae440ded96a67e42b77a27bc9fe4d5417e1b013a8c54a58c8876 - cead4fd08eaaae440ded96a67e42b77a27bc9fe4d5417e1b013a8c54a58c8876

Embedded URLs

http://wecan.hasthe.technology/upload
http://curl.haxx.se/docs/http-cookies.html

Embedded domains

example.com
curl.haxx.se
wecan.hasthe.technology
www.msftconnecttest.com
msedge.api.cdp.microsoft.com
www.bing.com
config.edge.skype.com
edge.microsoft.com
aps.prod.windows.com
dns.msftncsi.com
ecs.office.com
g.live.com
fs.microsoft.com
self.events.data.microsoft.com
www.msftncsi.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com
watson.events.data.microsoft.com

More Cymt samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report