MALICIOUS — virussign.com_93b192eb81fa44a518bb0709bfd36ad0.vir

MALICIOUS — virussign.com_93b192eb81fa44a518bb0709bfd36ad0.vir is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Rubinurd family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: fc434a87c3779df9a1486bb23e1c28d1cdbd4afe56dbb3ad9bfe42bad6e2a533
SHA-1: b2d34c1331c43c0cdb75ee590bb2f4f30e6ff6b0
MD5: 93b192eb81fa44a518bb0709bfd36ad0
imphash: 118eb37b88640d7f3f7ac979ea5687cc
ssdeep: 384:yVxX5dupK3WyzLeReRnnnLMDgPnKUYoFWTGs++s6n+bmQiyBCLg:swpKNiKL/PnSR52+KCLg
TLSH: T1F4300498C714966EC29BB51230D3889EF4A22BADF058D8BB59DA47B04CF44337C31D95
Submitted as: virussign.com_93b192eb81fa44a518bb0709bfd36ad0.vir
File type: pe · Size: 36864 bytes
Verdict: malicious (100/100) · Family: Rubinurd

Source: VirusSign · first seen 2026-08-25T00:00:00.000Z · SHA-256 verified

Detections (4 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Rubinurd-67
Microsoft Defender: flagged
Kaspersky (KVRT): HEUR:Trojan-Ransom.Win32.Blocker.gen

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Rubinurd-67 (rule Win.Trojan.Rubinurd-67) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Ransom.Win32.Blocker.gen (rule HEUR:Trojan-Ransom.Win32.Blocker.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

133 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\tsk_22a3717dc7ef4a60.exe - 2afa02fc29056a03c901fd4f7fbbe7f5060057e2a4d23cc0f657278ea4b92ac4

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.42.73.24
4.230.171.124
52.230.59.222
172.64.154.167
135.232.92.97
135.233.95.144
20.42.179.192
52.110.12.25
52.110.12.47

Registry keys

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

File paths

c:\temp\2015-05-01_22-53-25.dmp

More Rubinurd samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report