File verdict·Decided by the MT AI Engine
Our call

Suspicious

Unsigned installer with one tier-1 spyware label, direct-IP contacts, and mixed sandbox annotations.

xegumumune
Trust score48Caution
MechvibesDx_0.3.0_x64-setup.exe
62.7 MB
b233d7baa7c98f31883aac3fddd7
Antivirus engines
2 of 74 flagged
Code signing
Unsigned
Age
First seen 1y ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

62%Confidence
Moderate
Reasoning

The single tier-1 detection on a rare family name is not strong enough for a malicious verdict on its own. Direct-IP C2 behaviour raises concern, but the file is a common_old NSIS installer with no malicious children or sandbox consensus. Similar imphash matches were previously rated safe, though without signer overlap. The combination of limited detections, unsigned status, and suspicious network pattern places the sample in mixed-signals territory.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.tier1Malicious=1 (Kaspersky) with tier1FamilyConsensus.strong=false

  2. triggeredHeuristics[0].rule=MalwareTips.Synth.DirectIpC2 — 7 direct IPs, 0 domains

  3. signing.verified=false, unsigned NSIS-style installer (hasInstallerHint=true)

  4. similarHashes[0].verdict=safe and similarHashes[1].verdict=safe (imphash match, signerCoMatch=false)

  5. prevalence.classification=common_old, 385 unique sources

Points in its favour
  • 68 of 69 engines returned clean
  • Common_old prevalence with hundreds of prior submissions
  • No malicious dropped children or sandbox verdicts
Points against
  • Single tier-1 spyware detection on rare family
  • Direct-IP network contacts without domains
  • Unsigned executable
  • Community annotations reference RAT / trojan tags
What to do

Treat as untrusted until additional independent sandbox reports or a verified publisher signature can be obtained.

Threat family attribution

xegumumune corroborated by 2 sources

  • VT (74 engines)
    xegumumune
  • MT AI Engine
    xegumumune
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
23

Adversary techniques mapped to the MITRE ATT&CK framework.

T1010T1012T1027T1036T1056T1057T1059T1071T1082T1083T1112T1115T1125T1129T1134T1222T1497.001T1518T1518.001T1529T1543.003T1547.009T1574.002
Spawned processes
13
$(unnamed)
C:\Windows\system32\services.exe
$(unnamed)
"C:\Users\<USER>\Desktop\program.exe"
$(unnamed)
C:\Windows\Explorer.EXE
$(unnamed)
%SAMPLEPATH%\MechvibesDx_0.3.0_x64-setup.exe
$(unnamed)
C:\Windows\System32\UI0Detect.exe
$(unnamed)
C:\Program Files\Google3720_1654003696\bin\updater.exe
$(unnamed)
%SAMPLEPATH%\b233d7baa7c98f318836ebba49ce647530711f2130337f0aede13a3aac3fddd7.exe
$(unnamed)
C:\Program Files\Google3676_1500857121\bin\updater.exe
+5 more processes captured.
Network activity
9
IP addresses9
  • 224.0.0.251
  • 20.99.133.109
  • 23.55.140.42
  • 23.215.176.115
  • 23.32.75.5
  • 192.168.0.19
  • 20.69.140.28
  • 23.196.193.245
  • 23.216.147.23
Filesystem & mutexes
31
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\nsbF5CA.tmp\System.dll
  • C:\Users\<USER>\AppData\Local\Temp\nsbF5CA.tmp\modern-wizard.bmp
  • C:\Users\<USER>\AppData\Local\Temp\nsbF5CA.tmp\nsDialogs.dll
  • C:\Users\<USER>\AppData\Local\Temp\nsbF5CA.tmp\nsis_tauri_utils.dll
  • C:\Users\<USER>\AppData\Local\MechvibesDx\mechvibes-dx.exe
+10 more
Files deleted15
  • C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin
  • C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update
  • %USERPROFILE%\AppData\Local\Temp\nsvF33A.tmp\modern-wizard.bmp
  • %USERPROFILE%\AppData\Local\Temp\nsvBB4.tmp\modern-wizard.bmp
  • %USERPROFILE%\AppData\Local\Temp\nscEA03.tmp\modern-wizard.bmp
+10 more
Mutexes created1
  • cversions.3.m
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • fe17a424d0e8c66e3f6ef0316bNever scanned
    never seen before
  • 10704c370493de0277db0f343fNever scanned
    never seen before
  • 98f05bc7fa9baa149650872b8dNever scanned
    never seen before
  • abf64cfa14645043a7c38d4341Never scanned
    never seen before
  • fee1bd1daaa5efbcb93c27bc45Never scanned
    never seen before
  • 84c7ae138ff0f6612c07921724Never scanned
    never seen before
  • 775960107de6b41d9f3a8cd97cNever scanned
    never seen before
  • 8130560da30ad6f19994635594Never scanned
    never seen before
  • 385040a63033e211112b93259bNever scanned
    never seen before
  • 5ef1f010f9a8be4ffe09c1d266Never scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.

1 synthesis
MITRE ATT&CK profile
C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • DirectIpC2medium

    Sample contacted 7 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    20.99.133.109 · 23.55.140.42 · 23.215.176.115
Antivirus engine breakdown

2 detections across 74 engines

2 malicious0 suspicious72 clean
Tier-117 engines
1flag
Top commercial AVs (low FP rate)
Tier-240 engines
0flag
Mainstream engines with mixed FP rates
Low-trust17 engines
1flag
Heuristic / generic-AI engines (high FP rate)
Kaspersky
malicious
Trojan-Spy.Win32.Xegumumune.sbz
Rising
malicious
Spyware.Xegumumune!8.10962 (CLOUD)
Hash b233d7baa7c9… cross-referenced against 74 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 7.66Unpacked
Section entropy5 sections
.text
6.46
.rdata
5.02
.data
4.15
.ndata
0.00
.rsrc
6.73
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old
Unique uploaders
385
Hundreds of people have uploaded this — common.
Total submissions
448
Includes repeat uploads by the same source.
First seen by VT
1y ago
Jun 19, 2025
Prevalence quadrant
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
here
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
6/19/2025, 2:53:34 PM
First seen (MalwareBazaar)
Last analysis (VT)
7/9/2026, 5:53:23 PM
Scanned here
7/11/2026, 2:24:03 AM
File name
MechvibesDx_0.3.0_x64-setup.exe
Size
62.68 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
b233d7baa7c98f318836ebba49ce647530711f2130337f0aede13a3aac3fddd7
MD5
2cd8e3cc37ca1ad75b8d263c2f521f2b
SHA-1
d1185f2ae275e3dd5d1d642b14d826b10f896daa
PE imphash
56a78d55f3f7af51443e58e0ce2fb5f6
First seen (VT)
6/19/2025, 2:53:34 PM
Last analysis (VT)
7/9/2026, 5:53:23 PM
First scan (MalwareTips)
7/11/2026, 2:24:03 AM
Last scan (MalwareTips)
7/11/2026, 2:24:03 AM
Community reputation
-11flagged
Behavior tags
checks-user-inputoverlaydetect-debug-environmentpeexe
Frequently asked

Safety FAQ

Common questions about MechvibesDx_0.3.0_x64-setup.exe, answered from the scan data above.

  • MechvibesDx_0.3.0_x64-setup.exe is suspicious — treat it as unsafe until you're sure. 2 of 74 antivirus engines flag it (family: xegumumune), which isn't a strong consensus but is enough to be cautious. Don't run it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.
  • MechvibesDx_0.3.0_x64-setup.exe is a Windows executable program, about 62.7 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
  • 2 of 74 antivirus engines flagged MechvibesDx_0.3.0_x64-setup.exe, 2 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
  • Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
  • To remove MechvibesDx_0.3.0_x64-setup.exe: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original MechvibesDx_0.3.0_x64-setup.exe file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
  • MechvibesDx_0.3.0_x64-setup.exe is classified as an information stealer/spyware, built to harvest passwords, cookies, and wallet data. Engines attribute it to the xegumumune family. Knowing the family matters because it tells you the likely impact — data theft, remote control, file encryption, or unwanted ads — and guides the cleanup.
  • The SHA-256 hash of MechvibesDx_0.3.0_x64-setup.exe is b233d7baa7c98f318836ebba49ce647530711f2130337f0aede13a3aac3fddd7, and its MD5 is 2cd8e3cc37ca1ad75b8d263c2f521f2b. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
  • This report reflects the scan run on July 11, 2026. Because a file's hash never changes, the identity of MechvibesDx_0.3.0_x64-setup.exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.